Implementing Conditional Access Policies

One of the common challenges faced by security administrators is finding a balance between usability and security. This is especially relevant in a Microsoft 365 environment where users access cloud-based resources. It is not possible to wrap a firewall around Microsoft 365 in the traditional sense. Conditional Access is an Azure Active Directory (AD) feature that helps you address this challenge.

This chapter will show you how you can configure compliance policies for Conditional Access within your Microsoft 365 environment. You will learn how to allow or block access to the features in your tenant and how device compliance can be enforced with system security settings, such as a minimum password length and data encryption.

These topics will be covered in the following order:

• Explaining Conditional Access
• Conditional Access and Microsoft Intune
• Device-based Conditional Access
• App-based Conditional Access
• Monitoring...

Explaining Conditional Access

Azure AD Conditional Access is a feature within Azure AD Premium P1 and P2 and Microsoft 365 Business Premium. It is designed to provide a balance between security and productivity in modern workplace environments amidst employees’ increasing need to work from anywhere and on any device. Conditional Access enables Microsoft 365 administrators to control requests from devices and apps to access company resources.

This is achieved with granular access control policies that are used to define and apply conditions that determine whether access is granted or denied. The following are some examples of categories based on which conditions can be triggered:

• Location
• Device type
• Device state
• User state
• Application sensitivity

So, how does this work? The most basic description of a Conditional Access policy is when this happens > do this.

This combination of the condition with the access control makes up the Conditional...

Conditional Access and Microsoft Intune

While conditional access is a feature of Azure AD Premium, it integrates closely with Microsoft Intune to add mobile device compliance and mobile app management capabilities.

This is why Conditional Access may also be accessed by users with the appropriate roles and permissions from within Microsoft Intune (also commonly referred to as Microsoft Intune). The Microsoft Intune admin center is accessed via https://intune.microsoft.com and Conditional access may be found in the Devices section as shown in the following screenshot:

Figure 3.10: Conditional access from the Microsoft Intune admin center

Now that you understand the relationship between Conditional Access and Intune, let’s examine two more types of conditional access—device-based conditional access and app-based conditional access.

Introducing the types of Conditional Access

There are different applications of Conditional Access, which we will discuss in this section, starting with device-based policies.

Device-based Conditional Access

With device-based Conditional Access, you can ensure that only devices that are managed and compliant can access the services provided by Microsoft 365, such as Exchange Online, Software as a Service (SaaS) apps, and even on-premises apps. It is also possible to set specific requirements; for instance, that computers must be hybrid Azure AD-joined or require an approved client app for enrolment in Intune to access services.

Device policies can be configured to ensure device compliance and give administrators visibility on the compliance status of devices that have been enrolled in Microsoft Intune. This compliance status is passed to Azure AD, which then triggers a Conditional Access policy when users attempt to access resources. The Conditional Access policy either allows...

Monitoring Conditional Access events

As a security admin, an important part of your job will be to monitor and interpret any events that are recorded in relation to Conditional Access to ensure that it is doing its job correctly. In order to monitor and search for Conditional Access policy matches in Azure AD, you need to take the following steps:

1. From the Azure portal, select Azure Active Directory and choose Sign-in logs from the Monitoring section:

Figure 3.28: Monitoring Conditional Access

2. From the results displayed, filter by Conditional access:

Figure 3.29: Filtering by Conditional access

3. You can further filter the results by Success, Failure, or Not Applied:

Figure 3.30: Filtering results

Note

You can also monitor the device compliance status from the Microsoft Intune admin center by selecting Compliance status from the Devices | Overview...

Summary

In this chapter, you were introduced to Conditional Access policies in Azure AD. You learned how Conditional Access helps you address traditional security requirements with a modern approach; instead of configuring a firewall (which is not possible in a Microsoft 365 environment), you can configure policies in Azure AD and Microsoft Intune to provide additional protection for users and resources. You also learned how to create a simple Conditional Access policy as well as app-based and device-based policies integrated with Microsoft Intune. In addition, you explored how to utilize the Azure AD Sign-ins page to track successful, failed, and unapplied Conditional Access policy events.

Note

Azure AD Conditional Access also integrates with Azure AD Identity Protection and Microsoft Defender for Cloud Apps. These topics will be covered in later chapters of this book.

The next chapter will show you how role assignment and privileged identities can be used in Azure AD to...

Questions

1. Which of the following is not a possible response to a Conditional Access policy being triggered?
   1. Requiring Microsoft Defender for Identity
   2. Requiring MFA
   3. Requiring an approved client app
   4. Requiring a device to be marked as compliant
2. True or false? Conditional Access is included with an Azure AD Premium P1 license.
   1. True
   2. False
3. Which of the following may be used to configure Conditional Access Policies? Choose two options.
   1. Microsoft Intune Admin center
   2. Microsoft 365 Admin center
   3. The Azure Portal under Azure Active Directory | Security
   4. Microsoft 365 Compliance center
4. What are the two possible methods of bypassing Conditional Access?
   1. Setting named locations in Azure AD
   2. Using Role-Based Access Control (RBAC)
   3. Setting up MFA-trusted IPs
   4. Enabling self-service password reset
   5. Enabling pass-through authentication
5. True or false? With Microsoft Intune, you can use device-based compliance and app-based compliance in conjunction with Conditional Access.
   1. True
   2. False
6. Where would you...

Further reading

Please refer to the following links for more information:

• The following link is an example of a device compliance policy. Before configuring the device compliance policies, make sure that you are aware of all of the device types in your organization that you will need to protect: https://learn.microsoft.com/en-gb/mem/intune/protect/quickstart-set-password-length-android?wt.mc_id=4039827.
• The following link shows how to configure a device-based Conditional Access policy. When using these, always test them thoroughly with a small pilot group before targeting all users: https://learn.microsoft.com/en-gb/mem/intune/protect/create-conditional-access-intune.
• This policy helps you to set rules on your devices to allow access. The Ways to deploy device compliance policies section will give you a greater understanding of how to plan for device rules: https://learn.microsoft.com/en-gb/mem/intune/protect/device-compliance-get-started.
• This link will show you...