Forum Discussion

Björn Lagerwall's avatar
Björn Lagerwall
Brass Contributor
Mar 30, 2020

Conditional Access rule for Outlook Web exception

Hi,

 

To access O365 apps like Outlook, Teams, OneDrive, SPO we require an enrolled and compliant  Windows or iOS device. All external clients are Azure AD joined and Intune enrolled. 

 

Now, we want to do an exception for Outlook web access. All computers (web browsers) should be able to access OWA from a non-enrolled computer with MFA. Restrictions for read-only according to the article Conditional Access in Outlook on the web for Exchange Online will be applied to prevent data leakage (but not yet configured)

 

It's not working as we want, we believe it used to work... If we except O365 Exchange Online App in our Desktop Conditional Forward, Web Access is indeed accessible as we want. But, then you can also use a mail client on a non-enrolled Windows 10 to access e-mail.- Only web access should be allowed unless you have an aad-joined and enrolled computer. 

 

How do I fix this issue?

 

Thanks

/B

 

 

 

Conditional Access Rule

 

All users targeted (O365 emergency admin account excluded)

All Apps targeted (O365 Exchange Online excluded)

Client Apps

 

Grant

 

 

 

 

 

 

Azure Active Directory (AAD)
Conditional Access
microsoft intune

1 Reply

  • niklastinner's avatar
    niklastinner
    Brass Contributor
    May 16, 2020

    Hi,
    May you want to try to build 2 conditional access policies:
    1. for OWA (Browser) and maybe you will also have to add mobile apps and desktop clients - grant access with MFA or compliant device (require one of the selected controls)
    2. block access for everything else exept OWA (Browser) and desktop clients

    Hope I could help you.

Resources