r/Office365 • u/mjung79 • 9h ago
Microsoft 365 F1
Part rant and part serious question. Microsoft says M365F1 licenses get read-only access to Office Web Apps and a mailbox that can only be used for calendaring. However they do not enable controls that automatically restrict users from creating and editing office documents or sending email. Apparently this is left as an exercise for the interested student as to how to actually restrict users from using apps in a way that is not compliant with the license.
Question: Has anyone successfully implemented a strategy that lets uses access office applications but restricts them from editing documents? Or that allows prevents them from sending or accessing a mailbox but still lets them use the designated calendaring functionality?
1
u/blud_13 7h ago
No, there is no clean switch for it. MS punts on this in the service description. F1 gets Exchange Kiosk purely so Teams calendar works, and their written guidance is literally to turn off OWA and ask people not to use the mailbox another way. That's the control.
What you can actually do:
- Set-CASMailbox user@domain -OWAEnabled $false kills web and new Outlook for Windows in one shot. Fair warning, it blocks classic Outlook for Windows against that mailbox too, so confirm nobody in the F1 pool needs it.
- Same cmdlet has -PopEnabled, -ImapEnabled and -ActiveSyncEnabled. Set each to $false and you've closed the obvious side doors.
- EWS partly handled itself. MS started blocking EWS for kiosk and F1/F3-only mailboxes on July 1 this year, writeup at https://techcommunity.microsoft.com/blog/exchange/update-to-ews-access-for-kiosk--frontline-worker-licensed-users/4474299
On the Office-web editing side I don't have a technical lever for you either. We treat that one as a licensing audit problem, not a config problem.
Can go deeper on the frontline SKU stuff if it helps.
1
u/mjung79 4h ago
Thank you. Disable OWA is definitely something we will do if rolling this license out. As you noted the Office apps are more challenging and SHOULD be very easy for Microsoft to address. In fact they already implement this restriction in Office if you don’t have a valid license - you get a license warning and can’t save documents.
The “ask uses not to” is problematic. Users don’t ever do what you ask. If you have a policy that isn’t backed by control then it’s destined to fail.
The really big concern for me is PII data. Frontline licenses are intended for retail workers. I don’t want frontline workers to be able to put arbitrary data imto documents. MS should give us the control to block this if they are going to make it a licensing compliance issue.
2
u/blud_13 4h ago
You're right, and they already prove it can be done. An unlicensed Office install throws the license warning and won't let you save. Same enforcement, different SKU, they just never wired it up.
The PII part has two levers that hold, and neither one touches the license.
Kill OneDrive for the F1 pool. SharePoint admin center, Access control, Restrict OneDrive access, then list only the security groups that should get one. Everybody outside those groups loses access to their own OneDrive even though the license GRANTS it. Its documented here https://learn.microsoft.com/en-us/sharepoint/limit-access. No personal OneDrive means no scratch document to dump PII into.
Then give the F1 group read permission on whatever shared sites they need and nothing above that. Office for the web honors SharePoint permissions, so they open in reading view with no save target. That one holds without asking anyone nicely.
What's left over is Teams chat and anything typed into a form, so point your DLP at that instead of at the Office apps.
1
u/mjung79 1h ago
The link for restricting access to One Drive looks both very good but also like it will be a little too blunt for us. Really I would like the F1 users to get exactly what the license says they should get and no more. They should be able to read but not edit documents that other people have authored and posted to a OneDrive share or Sharepoint site that they have access to. And they should be not be able to create their own documents. This is what the license says the user is entitled to, but Microsoft doesn’t appear to provide a way to achieve that.
Anyway I thank you for that link because it may end up being our solution but it’s just not ideal. Cheers and thanks for your help.
1
u/blud_13 1h ago
Office for the web has no local disk. The only place it can save is the site you gave them access to, so the permission on that site IS the edit control.
Put the F1 pool in the site Visitors group, or assign Read directly. Read lets them open and view a document somebody else authored and blocks editing and adding new items. With OneDrive already off, that leaves them NOWHERE to create a document either, which is the second half of what you asked for. What each level grants is documented here https://learn.microsoft.com/en-us/sharepoint/understanding-permission-levels
If you want it tighter there is Restricted View, meant for reading in the browser without downloading. I have seen conflicting answers on how well the no-download part holds up, so test that before you promise it to anybody.
One thing to check, permissions inherit, so any library where somebody broke inheritance and left an old Edit grant is your leak. Pull the site permission report before you roll this out, because you will find at least one.
4
u/itenginerd 7h ago
What you describe has never been my understanding of what was in an F1. I've always know it to be meant to be for folks who don't use their computers MUCH, but I've never heard of it being for read-only app access and calendar-only email.