What blocking external access means and when you need it
Blocking external access means preventing anyone outside your organization from signing into your Outlook 365 account, even if they have your password. This is different from encryption — it stops the login itself before anyone can read your mail at all.
You need this when you want to may support only people on your company network can access your email. A contractor who left, a former employee, or someone who obtained your password cannot log in from home, a coffee shop, or anywhere outside your organization's network. Microsoft calls this conditional access when it's set up by your admin, but you can also restrict your own account from the Outlook settings.
The trade-off is real: if you travel, work from home, or use your phone to check mail outside the office, blocking external access will lock you out too. You'll need your admin to add exceptions for your devices or locations, or you'll need to turn the restriction off temporarily.
Key Takeaways
- You can block external access to your own account through Outlook settings, but your admin controls whether this actually works across your organization.
- Blocking external access stops all logins from outside your network, including your own from home or mobile — you need exceptions set up first.
- Your organization's admin can set up conditional access rules that block external logins automatically without you having to do anything.
- If you're an admin, blocking external access is done through Azure Active Directory or the Microsoft 365 admin center, not in Outlook itself.
How to restrict your own Outlook 365 account from external access
If you're a regular user and your organization allows it, you can add a restriction to your own account. Open Outlook on the web, go to Settings (the gear icon in the top right), then select View all Outlook settings. Click Security in the left menu.
Look for Advanced security or Session timeout options. Some organizations show a Restrict sign-in to specific locations option here — if yours does, you can enter your office IP address or network range. This tells Outlook to reject login attempts from anywhere else. However, this setting only works if your admin has enabled it for your tenant.
If you don't see these options, your admin has not turned on the feature for your organization. You cannot create this restriction on your own — you'll need to ask your IT department to set up conditional access rules instead.
What admins need to do to block external access across the organization
If you're an admin, blocking external access is not done in Outlook — it's done in Azure Active Directory or the Microsoft 365 admin center. Go to the Microsoft 365 admin center, select Security, then Conditional Access (this may be under Azure AD if your tenant is configured that way).
Create a new conditional access policy. Set the condition to Locations and choose Any location or Selected locations. If you select specific locations, you'll need to define them by IP address range or named location first. Then set the grant control to Block access. This policy will prevent any login attempt from outside those locations, regardless of password or multi-factor authentication.
Before you explore this policy, add exceptions for users who need to work remotely — otherwise your entire workforce will be locked out. You can exclude specific users, groups, or applications from the policy. Test the policy on a small group first, because a mistake here can lock out your entire organization.
The difference between blocking external access and blocking specific devices
Blocking external access stops logins from outside your network. Blocking specific devices stops logins from particular computers or phones, even if they're on your network. These are two separate controls.
If you want to block a stolen phone or a compromised laptop, you don't need to block all external access — you just need to remove that device from your trusted devices list or revoke its session. In Outlook on the web, go to Settings > Security > Sessions and sign out any device you don't recognize. This is faster and doesn't affect your ability to work from home.
Blocking external access is the right choice when you want to enforce a policy that nobody works from outside the office. Blocking a device is the right choice when you want to stop one specific person or computer from accessing the account.
What happens when external access is blocked
When external access is blocked, anyone trying to log in from outside your network will see an error message saying the sign-in was blocked by your organization's policy. They won't get a password prompt — the block happens before that. If it's you trying to log in from home, you'll see the same message.
The person who is blocked can contact your admin to request an exception, but the admin has to add them to an exclusion list or change the policy. There's no way for the blocked user to bypass it themselves. This is why it's important to set up exceptions for remote workers before you turn the policy on.
Your admin can see who tried to log in and was blocked by checking the Sign-in logs in Azure Active Directory. This shows the timestamp, the user, the location, and the reason for the block. If legitimate users are being blocked, the logs will show you which locations or devices need to be added to the exception list.
When blocking external access creates problems
Blocking external access assumes everyone in your organization works in the office. If you have remote workers, contractors, or people who travel, this policy will lock them out unless you set up exceptions first. Exceptions can be based on location (IP address range), user group, or specific process.
Another problem is that blocking by location is not perfect. If your office uses a VPN, you need to make sure the VPN's exit IP address is on the allowed list, or remote workers on the VPN will still be blocked. If you have multiple office locations, each one needs its own IP range in the policy.
Mobile devices are the hardest to manage this way. A user's phone has a different IP address everywhere they go — at home, at a coffee shop, at another office. If you want to block external access but allow mobile access, you'll need to use device-based conditional access instead, which checks whether the phone is enrolled in your mobile device management system.
Alternatives to blocking all external access
If blocking external access entirely is too restrictive, you have other options. Require multi-factor authentication for external logins — this stops attackers who have your password but not your phone. Go to Azure AD > Conditional Access and create a policy that requires MFA for logins from outside your network. Users can still work from home, but they have to verify with a second factor.
Restrict external access to specific apps instead of the entire account. You can block external access to Outlook on the web but allow it for the Outlook mobile app, or vice versa. This is useful if you want to prevent web access from untrusted computers but allow phone access.
Set a session timeout so that external sessions automatically sign out after a short time. This reduces the window of time an attacker has if they do get in. In Outlook settings, you can set sessions to expire after 1 hour, 6 hours, or 24 hours of inactivity.
Frequently Asked Questions
If I block external access, can I still use Outlook on my phone?
Not unless your admin sets up an exception for mobile apps. By default, blocking external access blocks all logins from outside your network, including from phones. Ask your admin to exclude the Outlook mobile app or your phone's device ID from the conditional access policy if you need phone access.
What if I'm traveling and need to check my email?
You'll be blocked unless your admin adds an exception for your location or device. Contact your IT department before you travel and ask them to either add your destination country to the allowed locations, enroll your device in mobile management, or temporarily disable the policy for your account. Don't wait until you're at the airport.
Can I block external access just for certain users?
Yes. Your admin can create a conditional access policy that applies only to specific user groups. This is useful if you want to block external access for finance or legal teams but allow it for sales or remote workers. The policy is set up in Azure AD and can target any security group in your organization.
Does blocking external access stop phishing emails?
No. Blocking external access only stops logins from outside your network. It does not filter incoming mail or stop someone from sending you a phishing email. For phishing protection, you need email filtering rules or advanced threat protection, which are separate settings.
If someone has my password and tries to log in from outside, will they be blocked?
Yes. Even if they have your correct password, the login will fail if it comes from outside your allowed network. This is the main reason to use external access blocking — it stops attackers even if they've compromised your password. However, if they're on your office network or a VPN connected to it, they can still log in.