Forum Discussion

Vineet Arora's avatar
Vineet Arora
Brass Contributor
Oct 06, 2017
Solved

Condition Access Question

Hi,   We have following business requirement. Only the devices issued/approved by IT departmernt should be able to access SharePoint Online. How can we acheive this using conditional or compliance...
Conditional Access
Intune
  • Christopher DelaTorre's avatar
    Christopher DelaTorre
    Nov 01, 2017

    Hi,
    The following article should help you set this up.

     

    https://cloudblogs.microsoft.com/enterprisemobility/2017/03/09/conditional-access-limited-access-policies-for-sharepoint-are-in-public-preview/

     

    https://support.office.com/en-us/article/Control-access-from-unmanaged-devices-5ae550c4-bd20-4257-847b-5c20fb053622?ui=en-US&rs=en-US&ad=US

     

    Also, in order for 'Use App enforce restriction' session access control to work. You have to set your organization to 'First-Release' for everyone. This will then update the sharepoint admin center access control page to set controls for sharepoint online access.

     

    Hope this helps!

John Guy's avatar
John Guy
Brass Contributor
Oct 14, 2017
Are your computers all Azure domain joined? I would say Conditional Access is your friend for this. Do you use Intune?
  • Vineet Arora's avatar
    Vineet Arora
    Brass Contributor
    Oct 15, 2017

    Hi,

     

    yes, we use EMS E3 (Intune and AD P1). 

     

    Can you please suggest how to make it work - Steps?

     

    Ideanlly, we want to have a workflow like below.

     

    - Have a policy in place that allows only Azure AD joined machines to access SharePoint Online.

    - Only Admins can join machines to Azure AD.

     

    Thanks,

    • Buddy Davies's avatar
      Buddy Davies
      Copper Contributor
      Oct 17, 2017

      If your machines are AAD joined or registered then you can create a condition access policy that defines the Who-What-How  and grants access for domain joined machines.

       

      Who: What users do you want the policy to apply to or exclude

      What: The services you wish for the policy to apply to

      How: The method of accessing the service (app or web browser).

       

      I hope that makes sense.

      • Vineet Arora's avatar
        Vineet Arora
        Brass Contributor
        Oct 18, 2017

        Hi,

         

        Thanks for your reply.

         

        The "Require domain joined" setting doesn't work. It seems it applies to On prem domain joined only.

         

        I am trying to use compliance condition. However, I don't want users to auto enroll. Only admin should be able to enroll.

         

        Thanks.

Resources