-description: "Learn about Microsoft Syntex - SharePoint Advanced Management and how you can use it in your organization."

-# Microsoft Syntex - SharePoint Advanced Management overview

-Microsoft Syntex - SharePoint Advanced Management is a Microsoft 365 add-on that provides a suite of features that can help you:

-With [Microsoft Entra authentication context](/azure/active-directory/conditional-access/concept-conditional-access-cloud-apps#configure-authentication-contexts), you can enforce more stringent access conditions when users access SharePoint sites.

-Note that this capability can't be applied to the root site in SharePoint (for example, https://contoso.sharepoint.com).

-In this article, we'll look at the example of requiring guests to agree to a [terms of use](/azure/active-directory/conditional-access/terms-of-use) before gaining access to a sensitive SharePoint site. You can also use any of the other conditional access conditions and access controls that you might need for your organization.

-1. In [Microsoft Entra Conditional Access](https://aad.portal.azure.com/#blade/Microsoft_AAD_IAM/ConditionalAccessBlade), under **Manage**, click **Authentication context**.

-2. Click **New authentication context**.

-4. Click **Save**.

-1. In [Microsoft Entra Conditional Access](https://aad.portal.azure.com/#blade/Microsoft_AAD_IAM/ConditionalAccessBlade), click **New policy**.

-1. On the **Grant** tab, select the check box for the terms of use that you want to use, and then click **Select**.

-1. Choose if you want to enable the policy, and then click **Create**.

-> This capability requires a Microsoft 365 E5 or Microsoft Syntex - SharePoint Advanced Management license.

-1. In the [Microsoft Purview compliance portal](https://compliance.microsoft.com/informationprotection), on the **Information protection** tab, click the label that you want to update and then click **Edit label**.

-2. Click **Next** until you are on the **Define protection settings for groups and sites** page.

-3. Ensure that the **External sharing and Conditional Access settings** check box is selected, and then click **Next**.

-7. Click **Next** until you are on the **Review your settings and finish** page, and then click **Save label**.

-If authentication context is set on a site, admins can choose to prevent background apps from accessing that site for the apps assigned with that authentication context in a conditional access policy. You can configure a conditional access policy such that a specific authentication context can be assigned to chosen application principles (non-Microsoft applications). You'll need to explicitly turn this feature on via the following cmdlet. Note that you should have at least one conditional access policy with an application principle configured.

-Set-SPOTenant -BlockAPPAccessToSitesWithAuthentcationContext $false/$true (default false)

-As a SharePoint Administrator or Global Administrator in Microsoft 365, you can block download of files from SharePoint sites or OneDrive. This feature does not need Microsoft Entra Conditional Access policies. This feature can be set for individual sites and cannot be set at the organization level.

-Blocking download of files allows users to remain productive while addressing the risk of accidental data loss. Users have browser-only access with no ability to download, print, or sync files. They also won't be able to access content through apps, including the Microsoft Office desktop apps. When web access is limited, users will see this message at the top of sites, "Your organization doesn't allow you to download, print, or sync from this site. For help contact your It department."

-Note that you can block the download of Teams meeting recording files specifically if you need to. For more information, see [Block the download of Teams meeting recording files from SharePoint or OneDrive](/microsoftteams/block-download-meeting-recording).

-This feature requires [Microsoft Syntex - SharePoint Advanced Management](advanced-management.md).

-3. Run the following command.

- For example, `Set-SPOSite -Identity https://contoso.sharepoint.com/sites/research -BlockDownloadPolicy $true`. You can apply this cmdlet to OneDrive as well by changing the URL to `https://contoso-my.sharepoint.com/personal/John`.

-Blocking download might impact the user experience in some apps, including some Office apps. We recommend that you turn the policy on for some users and test the experience with the apps used in your organization. In Office, make sure to check the behavior in Power Apps and Power Automate when your policy is on.

-[Microsoft Syntex - SharePoint Advanced Management overview](advanced-management.md)

-> This feature isn't supported for Microsoft 365 Government cloud customers, including GCC, GCC High or DoD.

-This feature requires either Microsoft 365 E5 or Microsoft Syntex - SharePoint Advanced Management.

-The OneDrive access restriction policy requires [Microsoft Syntex - SharePoint Advanced Management](advanced-management.md).

-To access the recent actions panel and the following features, your organization must have a [Microsoft Syntex - SharePoint Advanced Management subscription.](advanced-management.md)

-> Without Microsoft Syntex - SharePoint Advanced Management, you can only view actions made in the current session. Once you close the browser or sign out, the recent actions panel will clear the history.

-[Microsoft Syntex Advanced Management overview](advanced-management.md)

-The site access restriction policy requires [Microsoft Syntex - SharePoint Advanced Management](advanced-management.md).

-The site lifecycle management feature from Microsoft Syntex- SharePoint Advanced Management lets you manage inactive sites across your tenant from the [SharePoint admin center](get-started-new-admin-center.md).

-Site lifecycle management requires [Microsoft Syntex - SharePoint Advanced Management](advanced-management.md).