How to Restrict OneDrive Access Without Breaking Microsoft 365 Using Security Groups

Conditional Access policies are powerful tools for controlling access to Microsoft 365 resources. However, when they’re not configured carefully, they can cause unintended conflicts. One common issue many admins face is trying to restrict a user’s access to OneDrive, only to discover that the policy ends up blocking access to all Office 365 services. If this has happened to you, you’re definitely not alone. In this guide, I’ll show you a faster and more reliable method to restrict user access to OneDrive without impacting access to other Microsoft 365 resources. This approach avoids Conditional Access conflicts and is especially useful for organizations that work with external or guest users.

 Step 1: Create a Security Group Start by signing in to the Microsoft 365 Admin Center. 

Navigate to Teams & groups, then select Active teams & groups and create a new Security group. Give the group a clear name (for example, OneDrive-Allowed-Users). Once the group is created, open it and add only the users who should have access to OneDrive. Save your changes.

 Step 2: Restrict OneDrive Access from SharePoint Admin Center

Next, go to the SharePoint Admin Center. Expand Policies, then click on Access control. Select OneDrive access restriction and enable the option “Restrict OneDrive access to only users in specific security groups.” Search for and select the security group you created earlier, then save the configuration. That’s it. From this point forward, only users in the selected security group will be able to access OneDrive, while all other users will be restricted—without breaking access to Outlook, Teams, SharePoint, or other Microsoft 365 services.

 This method is highly recommended for tenants that invite external users, as it provides tighter control over data access while keeping the environment secure and user-friendly. Want a step-by-step video walkthrough to follow along visually? Click here to watch the full guide