Block Outlook App Externally

Hi @Denice Hall,

Welcome to the Microsoft Q&A forum.

Thank you for contacting us regarding blocking access to the Outlook app when users are outside of the organization.

To address this requirement, the recommended approach is to use Microsoft Entra Conditional Access in combination with trusted network locations. This allows you to clearly distinguish between internal and external access and apply restrictions accordingly.

Here are the steps you can try:

Please review the instructions carefully before implementing this policy.

We recommend testing the Conditional Access policy with a small pilot group of users first and excluding administrative or emergency (break‑glass) accounts to avoid unintended access issues.

1/ Create a trusted network location for your organization

You can follow the first 5 steps in this article to get started: Conditional Access - Block access by location - Microsoft Entra ID | Microsoft Learn

2/ Create a Conditional Access policy to block Outlook from non‑trusted locations

Follow the guidance in the following Microsoft article to block Outlook access based on trusted network locations:

Conditional Access - Block access - Microsoft Entra ID | Microsoft Learn

Note: When configuring the Conditional Access policy (Step 6 – Target resources), select Office 365 Exchange Online

Note: Microsoft Entra Conditional Access requires Microsoft Entra ID Premium P1 (or P2). The license must be assigned to each user included in (and benefiting from) the Conditional Access policy. For reference: Plan Your Microsoft Entra Conditional Access Deployment - Microsoft Entra ID | Microsoft Learn.

I hope this information is helpful. Please follow these steps and let me know if it works for you. If not, we can work together to resolve this.   

Thank you for your patience and your understanding. If you have any questions or need further assistance, please feel free to share them in the comments on this post so I can continue to support you.

I look forward to continuing the conversation.

If the answer is helpful, please click "Accept Answer" and kindly upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

To block users from using the Outlook App outside of the organization, you can implement Conditional Access policies. These policies can help manage access based on various criteria such as requiring multifactor authentication, blocking access from specific locations, or blocking risky sign-in behaviors. Additionally, you can use Exchange mailbox policies to restrict access to organization mailboxes from the Outlook app, ensuring that users cannot access their work or school accounts from outside the organization.

For more granular control, you can also configure OWA Mailbox Policies with the parameter ConditionalAccessPolicy to limit capabilities when users are on noncompliant devices.

For detailed guidance on setting up these policies, refer to the instructions on Conditional Access and OWA Mailbox Policies.

References:

• Control the installation and use of new Outlook
• Conditional access to the new Outlook App