Forum Discussion
Solved
Allow MS Teams via Conditional Access but block other O365 Services
I have been asked to see if the following is possible: Allow access to MS teams from anywhere for Voice/Video (we disable chat, file sharing via policy in the MS Teams admin portal) Block acces...
Thank you very much for this detailed response. This is exactly what we are bumping into also. We have folks using Teams (as expected) - on many different devices but we obviously do not want to grant EXO access to any device - thus we are stuck with the CAR stuff which is a major shortcoming. We are exploring using a solution from Palo Alto - Prisma VPN - to insure that our fleet of "compliant / trusted" devices can have secure access to EXO from anywhere.. This feels beyond ridiculous but not sure we have any other options. Again - thank you for taking the time to detail a great response here.
Ok, so I have not gotten another response from MS yet, but I did find this video that appears to be the answer. I have changed some configuration, but I have not tested yet. I am going to attempt to add a Condition, Filter for Device, and add exceptions for all of the registered Android devices. You may need to add them to all of the unsupported CA policies that may conflict with Android and Intune. It is all outlined in the video, though.
https://www.youtube.com/watch?v=uTQR_YuWZag
https://www.youtube.com/watch?v=uTQR_YuWZag
I can now confirm that with the DeviceIDs added to the Filter for Device conditions and the following list of excluded cloud apps, the Conditional Access policy is now working.
Microsoft Intune
Microsoft Intune Enrollment
Microsoft Stream Service
Microsoft Teams Service
Microsoft Whiteboard Services
Office 365 Sharepoint Online
ProjectWorkManagement
Skype for Business Online
Microsoft Intune
Microsoft Intune Enrollment
Microsoft Stream Service
Microsoft Teams Service
Microsoft Whiteboard Services
Office 365 Sharepoint Online
ProjectWorkManagement
Skype for Business Online