Office 365 Business premium, do not allow certain users OneDrive or email outside the building

I don't want certain users to be able to use / access OneDrive anywhere / anytime or get their work email from anywhere except their work station pc. I thought the simplest solution for this would be to just not let them know their password. After I do the initial setup of O365 on their work pc, from that point forward they would only be able to access email from there and OneDrive wouldn't work because I would have never signed on to it as them. But, I'm now thinking that's wishful thinking because at some point O365 will probably ask them to login again from their work pc for some Outlook, Word, or Excel reason.

How can I prevent certain users from ever accessing one drive at all and never being able to get work email except at their work pc?
pkromerAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Vasil Michev (MVP)Commented:
You can set up Conditional access policies to block access externally: https://docs.microsoft.com/en-us/azure/active-directory/active-directory-conditional-access-azure-portal-get-started

Or set up client sync restrictions (although that will not prevent them from accessing it via the browser): https://docs.microsoft.com/en-us/powershell/module/sharepoint-online/set-spotenantsyncclientrestriction?view=sharepoint-ps
0
pkromerAuthor Commented:
The IP  based access is great but it's global, so that won't work for me. Certain users WILL be able to access, all others won't, so it needs to be user based somehow.

We are not using Azure AD, there is no AD hookup to our O365. We may do that in the future but not until after we launch and the dust clears.
0
Big Business Goals? Which KPIs Will Help You

The most successful MSPs rely on metrics – known as key performance indicators (KPIs) – for making informed decisions that help their businesses thrive, rather than just survive. This eBook provides an overview of the most important KPIs used by top MSPs.

Vasil Michev (MVP)Commented:
Of course you are using Azure AD, it's the "backend" for O365. And I was referring to the "Restrict non-domain joined machines from syncing" for the cmdlet.
0
pkromerAuthor Commented:
I meant we do not have our local AD hooked up to O365. Any settings we change in the AD down here will not change up there... we need to do them manually in O365, like adding a user, removing a user, etc.
0
Vasil Michev (MVP)Commented:
Which still doesnt change the fact, that you are using Azure AD as part of Office 365.
0
pkromerAuthor Commented:
Ok, thanks all. I'll create a security group and allow certain people to create sites, all others won't be able to, which means no OneDrive for them because it's tied with Sharepoint. In addition, I'll disable all mail app options except desktop for the restricted users.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
pkromerAuthor Commented:
Much research while waiting for an answer to my exact question.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Office

From novice to tech pro — start learning today.