Block only one drive from external network

Unfortunately, AFAIK, you cannot completely block OneDrive application and web access from external networks while guaranteeing that SharePoint and Microsoft Teams channel file functionality remains fully operational using a standard Microsoft Entra Conditional Access policy. OneDrive and SharePoint use the same SharePoint Online service, and Conditional Access cannot independently target OneDrive and SharePoint sites through separate cloud app selections. Teams channel files are stored in SharePoint, so blocking the SharePoint Online service can also disrupt file access in Teams.

Conditional Access can restrict access to the SharePoint Online cloud app based on network location, using trusted corporate IP addresses and blocking access from other locations. However, this affects SharePoint Online access, including OneDrive and Teams channel files. It cannot selectively block the OneDrive desktop application and website while guaranteeing that SharePoint sites and Teams channel files continue to work.

An Intune App Protection Policy is not sufficient for this requirement. App protection policies control organizational data within supported applications, but they do not provide a general network-location-based block that prevents both OneDrive web access and desktop application access from external networks.

SharePoint Online provides additional controls that can restrict certain types of OneDrive and SharePoint access. For example, the Allow limited, web-only access setting in the SharePoint admin center can restrict downloading, printing, and synchronization on unmanaged devices. However, it does not completely block OneDrive web access, and it is not equivalent to a network-location-based OneDrive block.

SharePoint Online also supports controls for individual OneDrive sites, but these must be evaluated against the exact access requirements. A site-specific restriction does not automatically provide a complete external-network block for both the OneDrive application and website while preserving all SharePoint and Teams channel file operations.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin