> ## Content Index
> Fetch the complete content index at: https://www.myronhelgering.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Limited Access with Session Policies for Unmanaged Devices
- URL: https://www.myronhelgering.com/how-to-use-microsoft-defender-for-cloud-apps-to-configure-limited-web-only-access-for-unmanaged-devices/
- Published: 2023-07-10T08:12:53.000Z
- Updated: 2026-10-17T16:01:51.000Z
- Author: Myron Helgering
- Tags: Blog Posts, Blog Series: Unmanaged Devices, Microsoft Defender

In two previous blog posts, I wrote about enforcing limited web-only access on unmanaged devices using [Conditional Access policies](https://www.myronhelgering.com/configure-limited-access-for-unmanaged-devices-with-conditional-access/) or [Sensitivity Labels](https://www.myronhelgering.com/configure-limited-access-for-unmanaged-devices-with-conditional-access/). However, in this blog post, I will talk about a third method that achieves a similar web experience for unmanaged devices by utilizing session policies in Microsoft Defender for Cloud Apps (MDA).

You may wonder why you should choose this method over the others. Well, not only can we restrict downloading and printing of data, but we can also place other restrictions for example cut/copy data, which is not possible with the other methods. Additionally, user sessions with MDA will go through a proxy, which will enable session monitoring, and allows for the possibility of generating alerts.

While Microsoft Defender for Cloud Apps offers many more possibilities, today we will focus on preventing data leakage from unmanaged devices by restricting downloads, cut, copy, and print actions in Microsoft 365.

This post is divided in the following sections;

- [Licensing](#licensing)
- [Create Conditional Access app control policy](#create-conditional-access-app-control-policy)
- [Create activity for app control](#create-activity-for-app-control)
- [Create session policies](#create-session-policies)
- [User experience](#user-experience)
- [Wrap up](#wrap-up)

## Licensing

To make use of the session policy features offered by Microsoft Defender for Cloud Apps, you will need to ensure that each user who benefits from these features has the following licenses assigned:

- Microsoft Entra ID P1 license

AND

- M365 E5 subscription or one of the following add-ons: M365 Security E5, M365 Compliance E5, M365 Information Protection & Governance or Enterprise Mobility + Security E5.

## Create Conditional Access app control policy

Before proceeding to configure session policies in Microsoft Defender for Cloud Apps, we first need to create a Conditional Access policy. This policy will allow us to target specific user groups and enforce the session policies on those users.

1. Go to the [Microsoft Entra admin center](https://entra.microsoft.com/) and navigate to **Azure Active Directory > Protect & Secure > Conditional Access.**
2. Click **+New policy** to create a new Conditional Access policy and start by assigning some test users.
3. Configure the remaining settings of the policy to match the picture below, and then turn the policy **on**.

![Create Conditional Access Policy](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/create-conditional-access-policy-2.png)

Don't worry, this policy will not take effect until we have created a session policy in Microsoft Defender for Cloud Apps.

## Create activity for app control

If this is the first time you have created a Conditional Access app control policy, you will need to generate some activity in Microsoft Defender for Cloud Apps first. You can do this by signing into different M365 apps (such as OneDrive, Exchange Online, SharePoint Online, MS Teams) using at least one of the accounts included in the CA policy.

Afterwards, you can verify if the apps are connected to MDCA by visiting the [Microsoft Defender admin center](https://security.microsoft.com/) and going to **Settings > Cloud Apps > Conditional Access App Control apps**.

![App control connected apps](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/app-control-connected-apps.png)

Please note that it may take a short while for the apps to be successfully connected.

## Create session policies

With session policies in Microsoft Defender for Cloud Apps, we can enable real-time session monitoring and enforce specific restrictions on user activities. In this example, we will create two session policies to restrict cut, copy, print, and download actions on unmanaged devices.

Let's start by creating a session policy to restrict cut, copy, and print actions first. Follow these steps:

1. Go to the [Microsoft Defender admin center](https://security.microsoft.com/) and navigate to **Cloud Apps > Policies > Policy Management.**
2. Click on the **+Create policy** button and select **Session policy** to create the first session policy.
3. Enter a **name** for the session policy.
4. Select the **Block activities** session control type.
5. Select all **Microsoft 365** apps
6. Select the **Print and Cut/Copy item** activity types.

![Configure cut copy print session policy](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/configure-cut-copy-print-session-policy-1.png)

1. Select the **Block** action, or choose **Test** if you want to monitor user activities first.
2. **Uncheck** the option to create **alerts** unless you intend to actively manage them.
3. Click the **Create** button and let's move on to the second policy.

![Create session policy](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/create-session-policy.png)

Next, we can proceed to configure the second policy to restrict download actions. You can follow these steps:

1. Go back to **Policy Management**, click **+Create policy** and choose **Session policy** to create the second session policy.
2. Enter a **name** for the session policy.
3. Select the **Control file download (with inspection)** session control type.
4. Select all **Microsoft 365** apps

![Configure block download session policy](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/configure-block-download-session-policy.png)

1. Select the **Block** action, or choose **Test** if you would like to monitor user activities first.
2. **Uncheck** the option to create **alerts** unless you intend to actively manage them.
3. Click the **Create** button and you are done with creating the session policies.

![Create session policy 2](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/create-session-policy-2.png)

After successfully creating the session policies in Microsoft Defender for Cloud Apps, our configuration is complete, and we can now examine the results.

## User experience

Now, let's sign in from an unmanaged device using a user account that is included in the Conditional Access policy we created earlier, and see what the user experience is like.

![Session proxy notification](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/session-proxy-notification-1.png)

![session URL proxy](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/session-url-proxy.png)

![Download document from MS Teams](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/download-from-ms-teams.png)

![Download document blocked](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/download-blocked.png)

![Copy text out of document](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/copy-text-out-of-document.png)

![Copy text blocked](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/copy-blocked.png)

These restrictions will apply to the other Microsoft 365 services, including Microsoft Teams, OneDrive, Exchange Online, and SharePoint Online.

## Wrap Up

To wrap up this blog, I highly recommend considering blocking desktop app access for users working from unmanaged devices when implementing the session policies discussed here.

Without this, users will still be able to sign in to desktop apps and perform the actions like downloading, copying, cutting, and printing files from there. Do this at least until Microsoft offers similar capabilities to what Windows Information Protection (WIP) provided, which has been announced as [discontinued](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/announcing-the-sunset-of-windows-information-protection-wip/ba-p/3579282).

However, recently, Microsoft announced Mobile Application Management (MAM) for Windows. Read [this](https://www.myronhelgering.com/first-look-at-mam-for-windows/) blog post, where I take a first look at this brand new feature.

# Limited Access with Session Policies for Unmanaged Devices