Forum Discussion
Condition Access Question
Hi,
We have following business requirement.
Only the devices issued/approved by IT departmernt should be able to access SharePoint Online. How can we acheive this using conditional or compliance policies?
We don't have on prem AD.
Thanks,
Hi,
The following article should help you set this up.https://cloudblogs.microsoft.com/enterprisemobility/2017/03/09/conditional-access-limited-access-policies-for-sharepoint-are-in-public-preview/
https://support.office.com/en-us/article/Control-access-from-unmanaged-devices-5ae550c4-bd20-4257-847b-5c20fb053622?ui=en-US&rs=en-US&ad=US
Also, in order for 'Use App enforce restriction' session access control to work. You have to set your organization to 'First-Release' for everyone. This will then update the sharepoint admin center access control page to set controls for sharepoint online access.
Hope this helps!
7 Replies
Hi,
The following article should help you set this up.https://cloudblogs.microsoft.com/enterprisemobility/2017/03/09/conditional-access-limited-access-policies-for-sharepoint-are-in-public-preview/
https://support.office.com/en-us/article/Control-access-from-unmanaged-devices-5ae550c4-bd20-4257-847b-5c20fb053622?ui=en-US&rs=en-US&ad=US
Also, in order for 'Use App enforce restriction' session access control to work. You have to set your organization to 'First-Release' for everyone. This will then update the sharepoint admin center access control page to set controls for sharepoint online access.
Hope this helps!
Hi Christopher,
SharePoint access control did the job! However, I still have following questions/doubts.
1. Why manually created conditional access policies were not working with same settings?
2. Now, since I have this in place & working. How can I restrict only the IT admins to have capability to join Azure AD? A user can still join his home PC to Azure AD and conditional policy will allow him to access SharePoint.
3. How will I make the same working for other apps? e.g. Exchange online.
Many thanks!
- Are your computers all Azure domain joined? I would say Conditional Access is your friend for this. Do you use Intune?
Hi,
yes, we use EMS E3 (Intune and AD P1).
Can you please suggest how to make it work - Steps?
Ideanlly, we want to have a workflow like below.
- Have a policy in place that allows only Azure AD joined machines to access SharePoint Online.
- Only Admins can join machines to Azure AD.
Thanks,
If your machines are AAD joined or registered then you can create a condition access policy that defines the Who-What-How and grants access for domain joined machines.
Who: What users do you want the policy to apply to or exclude
What: The services you wish for the policy to apply to
How: The method of accessing the service (app or web browser).
I hope that makes sense.
Hey Vineet,
I am aware of the following solution, there could be other options;
To find out if a device is issued by the org/is compliant you would need a MDM solution like Intunes to find this information.
Once this is done you could leverage the azure ad conditional access policies to regulate the access.
