Restrict new file creation in Office desktop apps to Cloud Locations [MC1137593]

Message ID: MC1137593

Introduction

IT Administrators will be able to set up Word, Excel, and PowerPoint Windows applications to limit the creation of new files to only Cloud Locations (OneDrive, SharePoint, or third-party Clouds).

This configuration is called enablecloudonlysaveasmode is available only to IT Administrators and deployed using Group Policies. This policy is available now in the Administrative Template files for Microsoft Office (version 5516.1000 or newer).

For the policy to apply, users should be using a Windows version of Word, Excel and PowerPoints Version 2506 (Build 19029.20000) or newer.

This new Policy is part of a new set of tools for IT Administrators to move their organizations towards higher Cloud usage and Increase security and compliance: Files in the Cloud are automatically protected by your company’s security rules and labeling, so you don’t have to take extra steps to keep them safe and compliant.

This policy setting controls whether Word, Excel, and PowerPoint users can use non-Cloud locations (local and network) to create new files. If you enable this policy setting, users will only have Cloud Locations available to perform Save As and Save new files. If you disable or don’t configure this policy setting, users can use any location (Cloud, Local, and Network) to perform Save As and Save new files. Note: This policy setting only applies to subscription versions of Office, such as Microsoft 365 Apps for Enterprise.

When this will happen

• Public Preview: We will begin rolling out late August 2025 and expect to complete by mid-September 2025.
• General Availability (Worldwide, GCC, GCC High, and DoD): We will begin rolling out mid-September 2025 and expect to complete by late September 2025.

How this will affect your organization

If you do nothing, this change will have no impact on your organization.

If you enable the new Policy, Office will limit the creation of new Word, Excel, or PowerPoint files to Cloud Locations; Save and Save a Copy operations will only present Cloud locations and all local destinations will disappear from Office programs.

If Known Folders have been redirected to OneDrive (KFM), these folders are considered Cloud folders and they will be available for Save and Save a Copy operations.

What you need to do to prepare

If your organization already keep all Office files in the Cloud, this policy will prevent users from accidentally saving files outside of the Cloud.

If users in your organization still use local files, this policy will promote the creation of new files in the Cloud and prevent additional files to be created locally. You can communicate this change to end users explaining the advantages of saving the files to the Cloud instead of saving to local folders:

• Easy collaboration: It’s easy to work with others—just share your Cloud file to start collaborating right away. You and your team can add comments and make changes together, and AutoSave keeps your work updated in real time.
• Never lose your progress: Don’t worry about losing your work—files in the Cloud include AutoSave on, meaning your documents are automatically saved for you as you work.​
• Access from anywhere: Files you create in Word, Excel, or PowerPoint on Windows are instantly available from your Mac, web browser, iPhone, or Android device. When you make changes on one device, they are available from everywhere.

To minimize impact on users, we recommend moving (redirecting) known folders to OneDrive (Redirect and move Windows known folders to OneDrive – SharePoint in Microsoft 365)

To deploy this policy:

If you use Active Directory, Microsoft Entra or hybrid environments, you can use Group Policy Objects. Group policy can represent policy settings in the file system or in Active Directory Domain Services. When used with Active Directory, Group Policy settings are contained in a Group Policy Object (GPO). (Group Policy overview for Windows; Create and manage group policy in Microsoft Entra Domain Services – Microsoft Entra ID)

You can also use Cloud Policy Service: Cloud Policy service for Microsoft 365 lets you enforce policy settings for Microsoft 365 Apps for enterprise on a user’s device, even if the device isn’t domain joined or otherwise managed. When a user signs into Microsoft 365 Apps for enterprise on a device, the policy settings roam to that device. (Overview of Cloud Policy service for Microsoft 365 – Microsoft 365 Apps)

Learn More:

• Redirect and move Windows known folders to OneDrive – SharePoint in Microsoft 365
• Download Administrative Template Files (ADMX/ADML) for Microsoft Office
• Overview of Cloud Policy service for Microsoft 365 – Microsoft 365 Apps
• Group Policy overview for Windows
• Create and manage group policy in Microsoft Entra Domain Services – Microsoft Entra ID

Compliance considerations

Question	Answer and Explanation
Does the change store new customer data, if so, where, and is the data cached or permanently stored?	New files created in Word, Excel, and PowerPoint will be stored in Cloud Locations (e.g., OneDrive, SharePoint, or third-party Clouds) instead of local or network drives. These files are permanently stored in the Cloud.
Does the change alter how existing customer data is processed, stored, or accessed (e.g. documents, emails, chats, etc.), if so how and to what extent?	The policy restricts the ability to create and store new files locally, shifting data creation to Cloud Locations where files are subject to organizational compliance policies.
Does the change modify, interrupt, or disable any of the following capabilities (Purview)?	Files saved in the Cloud are automatically subject to Microsoft Purview compliance controls, including Information Protection labels, Data Loss Prevention (DLP), and retention policies.

Source: Microsoft

Latest Posts