Set up Restricted Search

You'll need the SharePoint Online Management Shell Application, Administrator access, and experience with PowerShell

Step 1. Check Current Status

Open SharePoint Online Management Shell.

Run the following PowerShell command to check if Restricted SharePoint Search is enabled.

Get-SPOTenantRestrictedSearchMode

This will return either Enabled or Disabled.

Step 2. Enable Restricted SharePoint Search

If the status is Disabled, enable it by running.

Set-SPOTenantRestrictedSearchMode -Mode Enabled

Step 3. Create an Allowed List

Identify the SharePoint sites you want to include in the allowed list.

Add these sites to the allowed list using the following command.

Add-SPOSiteToRestrictedSearchList -SiteUrl "https.//yourtenant.sharepoint.com/sites/sitename"

Repeat this step for each site you want to add.

Step 4. Verify the Allowed List

To see the current allowed list, run.

Get-SPOSiteFromRestrictedSearchList

Step 5. Manage the Allowed List

To remove a site from the allowed list, use.

Remove-SPOSiteFromRestrictedSearchList -SiteUrl "https.//yourtenant.sharepoint.com/sites/sitename"

Step 6. Monitor and Adjust

Regularly review and update the allowed list to ensure it meets your organisation’s needs.

Ensure that site permissions and data governance practices are up-to-date.

Set Up Conditional Access Policies

Creating Conditional Access policies helps you manage and secure access to your organisation’s resources. Here’s a step-by-step guide to get you started in Microsoft Entra ID 

Step 1. Administrator Access

Sign in to the Microsoft Entra admin center with your admin credentials.
From the left-hand menu Navigate to Security  > Click on Conditional Access.

Step 2. Create a New Policy

Click on + New policy to start creating a new Conditional Access policy.

Step 3. Configure Assignments

Select Users and Groups / Choose the users and groups to which this policy will apply. For example, you might include all employees but exclude the IT admin group.

Choose Cloud Apps or Actions / Select the cloud apps or actions that the policy will target. For instance, you might target Microsoft Teams and Outlook.

Step 4. Set Conditions

Risk Level / Apply the policy based on the risk level of the sign-in attempt. For example, require MFA for high-risk sign-ins.

Device Platforms / Target specific device platforms like iOS, Android, Windows, etc. For example, apply the policy only to Android devices.

Location / Apply the policy based on the geographic location or IP address of the sign-in attempt. For instance, enforce stricter controls for sign-ins from outside New Zealand.

Client Apps / Specify the types of client apps (e.g., browser, mobile apps) that the policy will affect. For example, apply the policy to all mobile apps.

Step 5. Configure Access Controls

Grant Controls / Choose the controls that must be satisfied to grant access. For example, require multi-factor authentication (MFA) or a compliant device.

Session Controls / Configure session controls to manage user access during a session, such as limiting the duration of the session or requiring reauthentication.

Step 6. Enable the Policy

Review your settings and enable the policy. It’s a good practice to test the policy with a small group of users before rolling it out organisation-wide.

Step 7. Monitor and Adjust

After enabling the policy, monitor its impact and make adjustments as necessary. You can view reports and logs to see how the policy is being applied and ensure it meets your security requirements.