Forum Discussion
Restricting client access to other Office 365 tenants
This article is pretty recent and describes how to perform tenant restrictions if you use a modern authentication client. Enables you to restrict what tenants can be accessed from your network.
https://docs.microsoft.com/en-us/azure/active-directory/active-directory-tenant-restrictions
Yup, now we do have options. It's great to see how many things can change around O365 in just few months!
Good an bad there. Only works with your network as the accessing permiter. Off your LAN/VPN it doesn't help. Also you need Azure AD P1 licensing to use it. And there is overhead with SSL decryption, inject a header, and encrypt to send it on its way.
- Deployed this for a Bank,. used a cloud proxy and GPO configurations to force clients through the proxy service to always ensure tenant restricions are applied. You also have the option from some AV vendors, to do the header insertion when accessing the login URL's. Combine this with conditional access, and you can get a solution that covers all scenarios. In terms of the SSL header injection overhead, it is just for the 3 login urls, when signing in to the service, so overhead is absolutely minimal.
- BrjannBrekkan
Microsoft
Currently Azure AD tenant restrictions is the way to accomplish this. Can you give an example of scenario where you would have to restrict access when your users are not on your network? Say for example that one of your employees work for a non profit or volunteers at a school that has O365, or they get invited by their kids to review their schoolwork on their school OneDrive. The only way to really accomplish that blocking would be to have your company laptops limit access in the local firewall (feature we dont have today to do what tenant restriction does but do it client side).
Brjann
- Azure AD Customer Success team
- tannerbriggs
Hi everyone,
Although not a complete solution, admins can configure Outlook client to prevent users from adding new accounts/profiles. This would stop employees from accessing other email services from the desktop client. However, OWA and other browser-based services would still be accessible without another control in place.
