Exchange Online: Limit External Email Access Without MAM

Need to reduce risk for external users or unmanaged devices, but you do not want to enrol them into MAM or manage the endpoint at all?

You can do this with Exchange Online OWA Mailbox Policies by limiting what Outlook on the web and the new Outlook for Windows can do.

What it does

• Prevents downloading attachments and other risky actions for unmanaged/external access.

• Works with Outlook on the web and new Outlook for Windows.

• No device enrolment necessary -> just policy configuration.

How to set it up

This is a two-step configuration. Exchange Online defines what is allowed (or not), Conditional Access decides when and for whom it applies.

Exchange Online (define what is allowed)

1. Install the Exchange Online PowerShell module (if not already installed)

Install-Module -Name ExchangeOnlineManagementInstall-Module -Name ExchangeOnlineManagement

2. Connect and view mailbox policies

Connect-ExchangeOnline

Get-OWAMailboxPolicy | Select-Object Name, ConditionalAccessPolicy

Connect-ExchangeOnline

Get-OWAMailboxPolicy | Select-Object Name, ConditionalAccessPolicy

3. Apply a restrictive policy (example: ReadOnly)

Set-OWAMailboxPolicy -Identity OwaMailboxPolicy-Default -ConditionalAccessPolicy ReadOnly`Set-OWAMailboxPolicy -Identity OwaMailboxPolicy-Default -ConditionalAccessPolicy ReadOnly`

OffNo conditional access policy is applied to Outlook on the web. This value is the default.ReadOnlyUsers can’t download attachments to their local computer, and can’t enable Offline Mode on non-compliant computers. They can still view attachments in the browser. This doesn’t apply to in-line images.ReadOnlyPlusAttachmentsBlockedAll restrictions from ReadOnly apply, but users can’t view attachments in the browser. This doesn’t apply to in-line images.

Conditional Access (enforce it for the right users)

Create a Conditional Access policy in Entra ID with these key settings:

• Users Target external users, guests, and/or specific groups

• Cloud app Exchange Online

• Filter Exclude: exclude compliant devices so the restriction only hits unmanaged ones.

• Access controls Enable App enforced restrictions

⚠️ This CA policy is mandatory. The OWA mailbox policy defines the restriction, but Conditional Access activates it.

Enduser Experience

When to use this

• External users and partners

• BYOD or shared devices

• Email access is required, but downloads and full access are not

Simple, effective, and no MAM involved.

Admin context

For Microsoft admins, the practical point in Exchange Online: Limit External Email Access No MAM is to treat the change as something that should be validated before it becomes tenant-wide behavior. Check the affected users, devices, assignments and support process so the Nugget turns into a controlled operational improvement instead of another undocumented setting.

Runbook notes for Exchange Online

Exchange Online: Limit External Email Access Without MAM deserves a little more operational context because the decision usually affects external email access. The related items are Exchange Online, external access, Conditional Access, unmanaged devices, mail security. Treat this Nugget as a starting point for a concrete tenant decision: who is in scope, which Microsoft portal or policy is touched, and what visible result should confirm that the configuration worked.

When validating Exchange Online, keep the test narrow enough to understand the result. Select one representative user, device, workload or subscription, capture the current state, then apply the change and compare the outcome. This avoids guessing later when support sees a different enrollment state, access result, model response, update status or admin center signal.

The most useful documentation for Exchange Online is practical rather than theoretical. Record the assignment logic, the owner, the expected monitoring view and the exception path. If the change affects users, include the wording support teams should use when they explain the behavior. If it affects devices or services, include the exact place where administrators can verify health.

For search consistency, keep the phrase Exchange Online: Limit External Email Access Without MAM connected to the body text, the internal links and the category context. That helps readers understand why this Microsoft admin topic belongs with the surrounding Intune, Entra, Azure, Copilot, Security or automation Nuggets, and it gives AI search systems clearer signals about the real subject of the page.

Revisit Exchange Online after the next rollout wave or Microsoft service update. Cloud behavior, licensing boundaries and portal labels can move quickly, so a short review prevents stale instructions. Confirm that the original assumption is still true, remove obsolete exceptions, and update the runbook if the operating model changed.