CA006-Global-DataProtection-Office365-AnyPlatform-Browser-Unmanaged-AppEnforceRestrictions

Policy conditions

Users

All users

Apps

00000003-0000-0ff1-ce00-000000000000, 00000002-0000-0ff1-ce00-000000000000

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies/$entity",
  "@odata.type": "#microsoft.graph.conditionalAccessPolicy",
  "@odata.id": "identity/conditionalAccess/policies('5ec953b4-0e21-423a-a45d-f3762453c945')",
  "@odata.editLink": "identity/conditionalAccess/policies('5ec953b4-0e21-423a-a45d-f3762453c945')",
  "templateId": null,
  "displayName": "CA006-Global-DataProtection-Office365-AnyPlatform-Browser-Unmanaged-AppEnforceRestrictions",
  "modifiedDateTime@odata.type": "#DateTimeOffset",
  "state@odata.type": "#microsoft.graph.conditionalAccessPolicyState",
  "state": "enabled",
  "deletedDateTime": null,
  "grantControls": null,
  "partialEnablementStrategy": null,
  "conditions": {
    "@odata.type": "#microsoft.graph.conditionalAccessConditionSet",
    "userRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
    "userRiskLevels": [],
    "signInRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
    "signInRiskLevels": [],
    "clientAppTypes@odata.type": "#Collection(microsoft.graph.conditionalAccessClientApp)",
    "clientAppTypes": [
      "browser"
    ],
    "platforms": null,
    "locations": null,
    "times": null,
    "deviceStates": null,
    "clientApplications": null,
    "agents": null,
    "applications": {
      "@odata.type": "#microsoft.graph.conditionalAccessApplications",
      "includeApplications@odata.type": "#Collection(String)",
      "includeApplications": [
        "00000003-0000-0ff1-ce00-000000000000",
        "00000002-0000-0ff1-ce00-000000000000"
      ],
      "excludeApplications@odata.type": "#Collection(String)",
      "excludeApplications": [],
      "includeUserActions@odata.type": "#Collection(String)",
      "includeUserActions": [],
      "includeAuthenticationContextClassReferences@odata.type": "#Collection(String)",
      "includeAuthenticationContextClassReferences": [],
      "applicationFilter": null
    },
    "users": {
      "@odata.type": "#microsoft.graph.conditionalAccessUsers",
      "includeUsers@odata.type": "#Collection(String)",
      "includeUsers": [
        "All"
      ],
      "excludeUsers@odata.type": "#Collection(String)",
      "excludeUsers": [],
      "includeGroups@odata.type": "#Collection(String)",
      "includeGroups": [],
      "excludeGroups@odata.type": "#Collection(String)",
      "excludeGroups": [
        "a8e55fcf-f8ed-43c2-bb4f-0c62edd62963"
      ],
      "includeRoles@odata.type": "#Collection(String)",
      "includeRoles": [],
      "excludeRoles@odata.type": "#Collection(String)",
      "excludeRoles": [],
      "includeGuestsOrExternalUsers": null,
      "excludeGuestsOrExternalUsers": null
    },
    "devices": {
      "@odata.type": "#microsoft.graph.conditionalAccessDevices",
      "includeDeviceStates@odata.type": "#Collection(String)",
      "includeDeviceStates": [],
      "excludeDeviceStates@odata.type": "#Collection(String)",
      "excludeDeviceStates": [],
      "includeDevices@odata.type": "#Collection(String)",
      "includeDevices": [],
      "excludeDevices@odata.type": "#Collection(String)",
      "excludeDevices": [],
      "deviceFilter": {
        "@odata.type": "#microsoft.graph.conditionalAccessFilter",
        "mode@odata.type": "#microsoft.graph.filterMode",
        "mode": "exclude",
        "rule": "device.isCompliant -eq True -and device.deviceOwnership -eq \"Company\""
      }
    }
  },
  "sessionControls": {
    "@odata.type": "#microsoft.graph.conditionalAccessSessionControls",
    "disableResilienceDefaults": null,
    "cloudAppSecurity": null,
    "signInFrequency": null,
    "persistentBrowser": null,
    "continuousAccessEvaluation": null,
    "secureSignInSession": null,
    "blockSensitiveActions": null,
    "applicationEnforcedRestrictions": {
      "@odata.type": "#microsoft.graph.applicationEnforcedRestrictionsSessionControl",
      "isEnabled": true
    }
  },
  "#microsoft.graph.restore": {
    "title": "microsoft.graph.restore",
    "target": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('5ec953b4-0e21-423a-a45d-f3762453c945')/microsoft.graph.restore"
  },
  "Tag": "jv-CAF-2026.2.1",
  "summary": "The CA006-Global-DataProtection-Office365-AnyPlatform-Browser-Unmanaged-AppEnforceRestrictions policy applies app enforced restrictions to browser sessions on unmanaged devices. It targets Exchange Online and SharePoint Online, using a device filter so only devices that are not compliant and company owned are caught. Paired with the right settings in SharePoint and Exchange, users on personal machines get limited, web only access where downloading, printing and syncing are restricted. People can still view content, but files never land on an untrusted device."
}