Getting conditional access right

Conditional access is a powerful tool that allows you to control access to your orginisations resources based on various conditions. This can include factors such as the user’s location, device, and risk level. In this post, we’ll go over the basics of how to configure conditional access for your organization.

First, it’s important to understand the different components of a conditional access policy. A policy consists of several parts: the users and groups it applies to, the cloud apps or actions it targets, the conditions under which it is enforced, and the access controls that are applied.

Below are the examples of conditional access that orginisations in todays enviroment should consider implementing

Block Legacy Authentication

Will block any devices using legacy authentication.

Under Assignments > Users or workload identities, Select All users under the heading include.
On the exclude heading, tick the users and groups item and add the Security Group called Conditional Access – Block Legacy Authentication – Exclude List.
Under Assignments > Cloud apps or actions, Select the radio button called All Cloud apps leaving ‘select what this policy applies to’ as the default value Cloud apps.Under Assignments > Conditions > Client Apps set the Configure button to Yes. and place a tick in the following options under Legacy authentication clients (ensure no modern authentication clients are selected) and click done: Exchange ActiveSync ClientsOther Clients.
Under Assignments > Access Controls > Grant set the radio button to Block access and set the Multiple controls to Require all the selected controls radio button.
Click Select to continue.

Physical location access control

Will block any devices from accessing system that are not from a trusted location (e.g., outside the UK)

Under Assignments > Users or workload identities, Select All users under the heading include.
On the exclude heading, tick the users and groups item, and add the Security Group called Conditional Access – Physical Access control – Exclude List.
Under Assignments > Cloud apps or actions, Select the radio button called All Cloud apps leaving ‘select what this policy applies to’ as the default value Cloud apps.
Under Assignments > Conditions > Locations set Configure to Yes and under include, select Any location.
Under Exclude Select Both MFA Trusted IPs and United Kingdom (The named location you created previously)
Under Assignments > Access Controls > Grant set the radio button to Block access and set the Multiple controls to Require all the selected controls radio button.
 Click Select to continue.

MFA for User access control

Will ensure all users have MFA assigned to them for accessing corporate data.

1. Under Assignments > Users or workload identities, Select All Users. under the heading include.
   On the exclude heading, tick the users and groups item, and add the Security Group called Conditional Access – User MFA – Exclude List.nder Assignments > Conditions > Client Apps set the Configure button to Yes. and place a tick in the following options under Modern authentication clients and click done: BrowserMobile apps and desktop clients
   Under Assignments > Access Controls > Grant set the radio button to Grant access and set the Require Multi-factor authentication tick box and set the Multiple controls to Require one of the selected controls radio buttons.
   Under Sessions > Sign-in frequency > periodic reauthentication set to the number of days or hours you would like MFA to be triggered such as 7 days
   Click Select to continue.

Device Compliance Check – MacOS Devices

Will ensure all MacOS devices are enrolled into Intune and listed as compliant if the device is not compliant the MacOS device will not be able to access data.

Under Assignments > Users or workload identities, Select All Users. under the heading include.
On the exclude heading, tick the All guest and external users.
Under Assignments > Conditions > Device platforms set the Configure button to Yes. and select the radio button Select device platforms and tick macOS tick box. Click done.
Under Assignments > Access Controls > Grant set the radio button to Grant access and set the Require device to be marked as compliant tick box and set the Multiple controls to Require one of the selected controls radio buttons.
Click Select to continue.

Device Compliance Check – Windows Devices

Will ensure all Windows devices are enrolled into Intune and listed as compliant, if the device is not complaint access on the Windows device will be blocked.

Under Assignments > Users or workload identities, Select All Users. under the heading include.
On the exclude heading, tick the All guest and external users.
Under Assignments > Conditions > Device platforms set the Configure button to Yes. and select the radio button Select device platforms and tick Windows tick box. Click Done.
Under Assignments > Access Controls > Grant set the radio button to Grant access and set the Require device to be marked as compliant tick box and set the Multiple controls to Require one of the selected controls radio buttons.
Click Select to continue.

MAM-WE App Protection Compliance Check – Mobile Devices

Will ensure all mobile devices accessing corporate data are complaint and added to mobile application management.

Under Assignments > Users or workload identities, Select All Users. under the heading include.
On the exclude heading, tick the All guest and external users.
Under Assignments > Cloud apps or actions, Select the radio button called All Cloud apps. Under the Exclude setting, add Microsoft Intune and Microsoft Intune Enrolment.
Under Assignments > Conditions > Device platforms set the Configure button to Yes. and select the radio button Select device platforms and tick Android and iOS tick box. Click done.
Under Assignments > Access Controls > Grant set the radio button to Grant access and set the Require app protection policy tick box and set the Multiple controls to Require one of the selected controls radio buttons.

Block unsupported devices

Will block any devices that are not supported by the organisation such as, Linux devices & Windows phones.

Under Assignments > Users or workload identities, Select All Users. under the heading include.
Under Assignments > Cloud apps or actions, Select the radio button called All Cloud apps.
Under Assignments > Conditions > Device platforms set the Configure button to Yes. and select the radio button Select device platforms and tick Windows Phone and Linux tick box. Click done.
Under Assignments > Access Controls > Grant set the radio button to Block access

Block high risk users

Using the aforementioned Azure AD Identity Protection user risk detections, policies can be created to block, require MFA, or password changes for high-risk users.

Under Assignments > Users or workload identities, Select All Users. under the heading include.
Under Assignments > Cloud apps or actions, Select the radio button called All Cloud apps.
Under Assignments > Conditions > User Risk set the Configure button to Yes. and select the radio button tick High tick box. Click done.
Under Assignments > Conditions > Sign-in Risk set the Configure button to Yes. and select the radio button tick High tick box. Click done.
Under Assignments > Access Controls > Grant set the radio button to Block

Require password change for medium risk users

Using the aforementioned Azure AD Identity Protection user risk detections, policies can be created to block, require MFA, or password changes for medium-risk users.

Under Assignments > Users or workload identities, Select All Users. under the heading include.
Under Assignments > Cloud apps or actions, Select the radio button called All Cloud apps.
Under Assignments > Conditions > User Risk set the Configure button to Yes. and select the radio button tick Medium tick box. Click done.
Under Assignments > Access Controls > Grant set the radio button to Require password change

Token protection

Under Assignments > Users or workload identities, Select All Users. under the heading include.
Under Assignments > Cloud apps or actions, Select the radio button called Select apps. Select Office 365 Exchange Online & Office 365 SharePoint Online. Click Done
Under Assignments > Conditions > Device platforms set the Configure button to Yes. and select the radio button Select device platforms and tick Windows tick box. Click Done.
Under Assignments > Conditions > Client Apps set the Configure button to Yes. and select the radio button Modern authentication clients and tick Mobile apps and desktop clients tick box. Click Done.
Under Assignments > Sessions > Require token protection for sign-in sessions (Preview) tick Done.

In summary, configuring conditional access involves creating a policy that specifies the users and cloud apps it applies to, the conditions under which it is enforced, and the access controls that are applied. By carefully crafting your conditional access policies, you can ensure that your orginisations resources are protected and only accessed by authorized users under the right conditions.

If you would like a copy of the conditional access policies, I have highlighted above they can be downloaded as a HTML file for an easier view to create within your own tenant.