Forum Discussion
Conditional policies in Azure AD vs. Intune
We are planning to deploy ODB for about 10000 users.
The main issue right now is controlling the access and dealing with compliance.
There are a few things that I need some clarification on;
The end goal here is to have MFA prompts for internal/external users who try access SPO/ODB from outside of trusted networks, regardless of the devices being managed/unmanaged.
First;
We already have MFA set up over here with DUO Mobile Security; Can the same MFA be used for O365 when users access resources outside of the trusted network?
Secondly;
For Device management (MDM) there is Airwatch in place already that has all the managed devices registered.
We are intending to use Azure Conditional access control for this scenario but the documentation says that the MDM used for this is Intune, my question is can the current MDM Airwatch be used to feed information to Azure AD policies about a device being compliant or not?
This is what we intend to apply to control access from unmanaged devices that are not on the network.
If you want to use custom MFA provider, you have to federate with your on-premises AD or use 3rd part federation. Azure AD Conditional access only supports Azure MFA as a second factor.
Hi Vasil,
Thank you for the quick response.
Would the following hold true?If yes, then maybe a custom MFA provider could be used with AAD Conditional access.
Configure federation services to provide multi-factor authentication
For federated tenants, MFA may be performed by Azure Active Directory or by the on-premises AD FS server.
By default, MFA will occur at a page hosted by Azure Active Directory. To configure MFA on-premises, the –SupportsMFA property must be set to true in Azure Active Directory, by using the Azure AD module for Windows PowerShell.
Yes, with AD FS (or third party federation solution) you can use custom providers, but it requires you to have the domain federated. And if you are federated, you can implement the conditional policies on the AD FS server, no need to pay the Azure AD Premium license for AAD Conditional access.
