A group of Microsoft Products and technologies used for sharing and managing content, knowledge, and applications.
Based on Control access from unmanaged devices – SharePoint in Microsoft 365 | Microsoft Learn, Microsoft does not support allowing users on unmanaged (non-domain-joined) devices to open and edit SharePoint or OneDrive files in desktop Office applications while simultaneously preventing downloads.
The supported options are:
- Allow desktop Office applications: Users can open and edit files, but the requested download restriction cannot be enforced through the unmanaged-device access controls.
- Prevent downloads: Configure unmanaged-device access to Allow limited, web-only access. Users can view and edit supported Office files in a browser, but desktop Office application access is restricted.
Go to SharePoint admin center and select Policies > Access control > Unmanaged devices.
Therefore, if blocking downloads is mandatory, browser-based access is the supported approach. If desktop Office application access is also mandatory, the requirements cannot all be met using these unmanaged-device access controls.