SharePoint Restrict IP

Question

Hi,

Is it possible to restrict specific users’ access based on their IP?

For instance, as an administrator, I would like to be able to access SharePoint online regardless of where I am located (on the road, using LTE, at home, etc). However, I would like certain other people on the site to only be able to access the SharePoint when they are at work, at this specific location.

Is there a solution for this?

Thank you

Answer 1

Hi Lucy_055,

Yes, it is possible. As an admin, you can control access to SharePoint and OneDrive resources in Microsoft 365 based on defined network locations that you trust. This is also known as location-based policy.

Once you define the authorized IP address ranges, any user who attempts to access SharePoint and OneDrive from outside this network boundary (using web browser, desktop app, or mobile app on any device) will be blocked.

For this, follow the steps below:

1. Go to the Access control page of the new SharePoint admin center, and sign in with an account that has admin permissions for your organization.
2. Select Network location, and turn on Allow access only from specific IP address ranges.
3. Enter IP addresses and address ranges separated by commas.
4. Click Save.

For detailed information, see Control access to SharePoint and OneDrive data based on network location

Regards,

Neha

Answer 2

Hi Lucy_055,

Yes, it is possible. As an admin, you can control access to SharePoint and OneDrive resources in Microsoft 365 based on defined network locations that you trust. This is also known as location-based policy.

Once you define the authorized IP address ranges, any user who attempts to access SharePoint and OneDrive from outside this network boundary (using web browser, desktop app, or mobile app on any device) will be blocked.

For this, follow the steps below:

1. Go to the Access control page of the new SharePoint admin center, and sign in with an account that has admin permissions for your organization.
2. Select Network location, and turn on Allow access only from specific IP address ranges.
3. Enter IP addresses and address ranges separated by commas.
4. Click Save.

 

For detailed information, see Control access to SharePoint and OneDrive data based on network location

Regards,

Neha

Hi Neha,

I am attempting to restrict SharePoint access by specific IP addresses as instructed in the documentation you linked. However, I am running into the following issue: Make sure the IP addresses and ranges are separated by commas, use CIDR notation, and don't overlap. Also make sure you allow your current IP address.

Even the most simple test, when I am only including my own IP address, does not work.

Any guidance would be greatly appreciated.

Thanks,

Lucy

Answer 3

Thank you Neha.

Answer 4

Hi Lucy_055,

If you want to restrict SharePoint access for everyone expect for some users, you will need Azure AD conditional access policies. For an overview of conditional access in Azure AD, see Conditional access in Azure Active Directory. Please note, using this feature requires an Azure AD Premium P1 license.

For detailed information on how to create the policy, see Block access to SharePoint for specific users

Regards.

Neha

Answer 5

Hi Neha,

Thanks for your fast reply!

I am aware that I can restrict based on IP address. However, I (as an administrator) want to be able to access SharePoint and OneDrive business wherever I am. This would not be possible for me if I were to add a restriction on the allowed IP addresses, because I won’t be able to access SharePoint when using cellular data for example.

I want to be able to restrict IP address for my employees, but not be restricted by these IP addresses myself. Specifically, I want to be able to access SharePoint even on the road (cellular data), at another location outside of my home with an IP I simply cannot predict beforehand (for example if I am travelling).

Thus, I am wondering if it is possible to allow certain users to NOT be affected by the IP restrictions I set?

Thank you so much, hope this is clearer.

Lucy