Forum Discussion
How to avoid login to other tenants?
Hello,
The reason you see this done at the proxy is because of how logistically this works.
If your end user is getting the prompt/login to an incorrect tenant, or they themselves are navigating to an incorrect tenant, how is Microsoft supposed to do anything to re-direct or block that. They can deny the login, but they do not control your users network. Also keep in mind, for many O365 users, end users from tenant A can login to the same spot as end users from tenant B. Its only when you get to on-prem resources and hybrid setups that you are getting to unique login locations. (ADFS anyone?).
Even stuff like conditional access are designed around restricting access into your tenant, not restricting your users access into other places.
Hence why all the solutions you are finding about a proxy, as then you have a way to control the outbound traffic of your users from your network.
In MDM/Intune, once the devices are registered and online, you then do have more autonomy. You can do things like prescribe down the applications and settings your users are using so that they are not only connecting to your system/wifi/whatever as you want, but doing it on a certain version of a browser or application.
The issue you have here is similar to the proxy conversation though. This only works once your users are registered or joined to the Intune/MDM system. Prior to their devices being joined, Microsoft again has no control over where they browse or navigate.
If you have a chain problem with this, then yes Intune could kind of solve this for you, if you are controlling the device and getting it registered into Intune prior to giving it to the user. If the user gets the phone, and the first thing they are required to do is register it, this could help too. But if you send me a phone, and I go to a clients system before registering with Intune, and their wifi tries to get me to login to their Skype server, well if I give it the credentials, thats on me as a user.
Hope this makes sense. Intune may be a good solution if you are really worried about this problem. To me though this sounds like an end user knowledge/education issue, not one that inherently needs a technology solution outside of what exists today.
Adam
Adam,
At first, big thanks about your great answer!
Few ideas comes to my mind, I do not expect that Microsoft should be aware into which tenant I should go. But isn't great if we could define on the MDM/Intune that when EndUserA sign-in to our Skype-/Exchange online administrator could define into which tenant that user can go until with those apps? So I'm a bit wishing to see that applications can be aware of what is allowed to be done and what is not.
Also it is important to see that none of the solutions are bullet proofs, but sometimes some tiny block could save your day.
Whilst the options available right now are not as mature as you would like, the proxy solution https://docs.microsoft.com/en-gb/azure/active-directory/manage-apps/tenant-restrictions is a sound configuration. Saying that however, certain functions are unique to certain service workloads. For example you can block synchronisation of OneDrive for Business unless the workstation is on a specific domain as an example. This doesn't need Intune, it's available in the OneDrive for Business Admin Center.
In any case, expect protocols on how we access apps and data to change and evolve quite radically in the next 18 months.
- Microsoft is suggesting that you bypass proxies, but that is so that data access is not limited and cause applications to run slow. But to do tenant restrictions you need to proxy authentication traffic, and not all traffic - so you can do it and not impact performance, but it takes time and a good design
