diff --git a/frontend/components/top_nav/SiteTopNav/SiteTopNav.tsx b/frontend/components/top_nav/SiteTopNav/SiteTopNav.tsx
index 34f2769be5..6be6228237 100644
--- a/frontend/components/top_nav/SiteTopNav/SiteTopNav.tsx
+++ b/frontend/components/top_nav/SiteTopNav/SiteTopNav.tsx
@@ -13,7 +13,7 @@ import UserMenu from "components/top_nav/UserMenu";
 // @ts-ignore
 import OrgLogoIcon from "components/icons/OrgLogoIcon";
 
-import navItems, { INavItem } from "./navItems";
+import getNavItems, { INavItem } from "./navItems";
 
 interface ISiteTopNavProps {
   config: IConfig;
@@ -191,13 +191,14 @@ const SiteTopNav = ({
     );
   };
 
-  const userNavItems = navItems(
+  const userNavItems = getNavItems(
     currentUser,
     isGlobalAdmin,
     isAnyTeamAdmin,
     isAnyTeamMaintainer,
     isGlobalMaintainer,
-    isNoAccess
+    isNoAccess,
+    isSandboxMode
   );
 
   const renderNavItems = () => {
diff --git a/frontend/components/top_nav/SiteTopNav/navItems.ts b/frontend/components/top_nav/SiteTopNav/navItems.ts
index 9f482a4e58..203e14f597 100644
--- a/frontend/components/top_nav/SiteTopNav/navItems.ts
+++ b/frontend/components/top_nav/SiteTopNav/navItems.ts
@@ -20,7 +20,8 @@ export default (
   isAnyTeamAdmin = false,
   isAnyTeamMaintainer = false,
   isGlobalMaintainer = false,
-  isNoAccess = false
+  isNoAccess = false,
+  isSandboxMode = false
 ): INavItem[] => {
   if (!user) {
     return [];
@@ -59,7 +60,7 @@ export default (
         regex: new RegExp(`^${URL_PREFIX}/controls/`),
         pathname: PATHS.CONTROLS,
       },
-      exclude: !isMaintainerOrAdmin,
+      exclude: isSandboxMode || !isMaintainerOrAdmin,
       withParams: { type: "query", names: ["team_id"] },
     },
     {
diff --git a/frontend/router/index.tsx b/frontend/router/index.tsx
index cf06b31b1f..15108238ca 100644
--- a/frontend/router/index.tsx
+++ b/frontend/router/index.tsx
@@ -170,14 +170,16 @@ const routes = (
             </Route>
           </Route>
 
-          <Route path="controls" component={AuthAnyMaintainerAnyAdminRoutes}>
-            <IndexRedirect to="mac-os-updates" />
-            <Route component={ManageControlsPage}>
-              <Route path="mac-os-updates" component={MacOSUpdates} />
-              <Route path="mac-settings" component={MacOSSettings} />
-              <Route path="mac-settings/:section" component={MacOSSettings} />
-              <Route path="mac-setup" component={MacOSSetup} />
-              <Route path="mac-setup/:section" component={MacOSSetup} />
+          <Route component={ExcludeInSandboxRoutes}>
+            <Route path="controls" component={AuthAnyMaintainerAnyAdminRoutes}>
+              <IndexRedirect to="mac-os-updates" />
+              <Route component={ManageControlsPage}>
+                <Route path="mac-os-updates" component={MacOSUpdates} />
+                <Route path="mac-settings" component={MacOSSettings} />
+                <Route path="mac-settings/:section" component={MacOSSettings} />
+                <Route path="mac-setup" component={MacOSSetup} />
+                <Route path="mac-setup/:section" component={MacOSSetup} />
+              </Route>
             </Route>
           </Route>