Restricting client access to other Office 365 tenants

Copper Contributor

Hi,

   When allowing connectivity into Office 365, is there a way to restrict access to a single a tenant? For the purposes of DLP I need to prevent internal machines logging onto any another email service including other 365 tenants, how could this be acheived? 

 

Google offer a way to restrict this by using additional headers -> https://support.google.com/a/answer/1668854?hl=en

 

Many thanks,

 

-Ben

20 Replies

That`s something I have to deal with, too.

 

For me it is allowing access only to company devices. Intune doesn`t offer that.

 

Ben, for other Office 365 tenants you simple give to user no license in this tenant. So they will have no Mail account there.

 

As for orther mail systems you can block the URLs for example.

 

Hope that helps.

 

Mark

Hi Mark,

     Thanks for the reply. I undertstand around the restrictions for logging onto our own tenant and we have those in place.

 

The scenario I'm thinking about is when say for example a contractor was logged on to one of our corporate machines and they had their own tenant. Whats to stop them from spinning up a browser or outlook and logging on to their own account and emailing information out that way. All we would see at the proxy level is legitimate encrypted traffic to outlook.office365.com.

 

I'm interested to see how other people have dealt with this.

 

Cheers,

 

-Ben

 

 

One way to prevent this would be to implement Rights Management. When the contractor has finished their job, the rights to the affected files will no longer be available to them.

 

Another way to mititigate this risk is to ensure that the appropriate clauses are in your contracts and to have the contractors sign an appropriate "terms of use" document.

Hi Dean,

    Thanks for the reply. Both are good suggestions but unfortunatley I can't see them as being practical ways to prevent data leakage. To encrypt all our data and work out an effective rights management policy would take a very long time and although its an extreme example, I'm pretty sure Snowden filled out some sort of AUP :)

 

The only way I can see to restrict data leakage to another tenant at the moment is to look at SSL Inspection and apply some form or URL filtering ... whilst it could be effective, it's not a supported solution by Microsoft and they activley discourage it.

 

-Ben

If Rights Management had been enabled Snowden would  not have been able to use the files he stole.IRM/RMS is the most effective way to mitigate the risks associated with data that has leaked.

 

The Data Loss Prevention policies in O365 and now in Flow can help mitigate the risks.

 

Advanced Threat Analytics (ATA) can be used to identify abnormal behavior, such as large number of file downloads, but this is only good for on-premises systems.

 

Azure Security Center can be used to monitor network traffic from many applications for suspicios behavior, see https://azure.microsoft.com/en-us/documentation/articles/security-center-detection-capabilities/

 

There's no way to do this in O365, even if you have AD FS in place. You can probably use a similar solution to what's described in the article, with inspecting all traffic to O365, but I wouldnt really recommend such approach. As Dean mentioned, there are plenty controls available as part of O365 or additional services to secure access to your data, one of them (or a combination) should meet your needs.

This article is pretty recent and describes how to perform tenant restrictions if you use a modern authentication client.  Enables you to restrict what tenants can be accessed from your network.

https://docs.microsoft.com/en-us/azure/active-directory/active-directory-tenant-restrictions

Yup, now we do have options. It's great to see how many things can change around O365 in just few months!

Good an bad there.  Only works with your network as the accessing permiter.  Off your LAN/VPN it doesn't help.  Also you need Azure AD P1 licensing to use it.  And there is overhead with SSL decryption, inject a header, and encrypt to send it on its way.

Currently Azure AD tenant restrictions is the way to accomplish this. Can you give an example of scenario where you would have to restrict access when your users are not on your network? Say for example that one of your employees work for a non profit or volunteers at a school that has O365, or they get invited by their kids to review their schoolwork on their school OneDrive. The only way to really accomplish that blocking would be to have your company laptops limit access in the local firewall (feature we dont have today to do what tenant restriction does but do it client side).

 

Brjann

- Azure AD Customer Success team

Hi This is done Through Tenant Restrictions.

 

You'll configure your outbound Proxy server, to insert a "Restrict-Access-To-Tenants: <permitted tenant list> header in packets bound to login.microsoftonline.com, login.microsoft.com, and login.windows.net

 

You'' then Go to your O365 Tenant, and configure Tenant restrictions.

 

For this to work, the Proxy needs to support SSL inspection, in order to insert the header.

 

End result will be:

Scenario: User tries to access outlook.office.com to get access to his Tenant (contractor.onmicrosoft.com)

 

Once he enters the url, open outlook / client to access Saas service, he gets redirected to AzureAD (url's listed above for login)

 

Proxy intercepts traffic to AAD and inserts HTTP header, indicating yourtenant.onmicrosoft.com is the only allowed tenant, and controcator.onmicrosoft.com is not allowed.

 

AAD does not issue a service token for the contractor.onmicrosoft.com user, so the client cannot Authenticate to gain access to the Saas Service.

 

 

This works for controlling access to Microsoft Tenants from your Network, so if the Contractor can connect his mobile phone as a hotspot, or bypass your network security controlls (Proxy Server), then this wont work. So additional controls might need to be implemented to ensure your DLP controls are enforced when using Tenant restrictions in O365.

You can use Intune's Conditional Access function to restrict access to company devices. Assuming that your definition of a 'company device' is one that is enrolled in Intune.

Hi everyone,

 

Although not a complete solution, admins can configure Outlook client to prevent users from adding new accounts/profiles. This would stop employees from accessing other email services from the desktop client. However, OWA and other browser-based services would still be accessible without another control in place. 

how to block non-business tenant outlook access (eg. Hotmail)?


One way to keep people from access Software as a Service systems like Hotmail, is with Cloud App Security. It can be used to prevent access to thousands of different apps like this.
Like I mentioned before, the solution for this is a technology called tenant restrictions. This will prevent a contractor from loggin in to another Tenant, whilst on your network / devices. It is exatcly the same solution that Google has as mentioned above.
Tenant restrictions will do the job, Rights management will also, but there are way more considerations for Rights management. For example, if you have CAD drawings or content types that does not support Rights Management encryption natively, then Tenant restrictions would solve the issue. Rights management is better for Zero Trust models however, so should not be overlooked, but rather combined with tenant Restrictions.
This is not true. Tenant Restrictions is the name of the technology to acheive this. Google / Bing "microsoft tenant Restrictions"
Deployed this for a Bank,. used a cloud proxy and GPO configurations to force clients through the proxy service to always ensure tenant restricions are applied. You also have the option from some AV vendors, to do the header insertion when accessing the login URL's. Combine this with conditional access, and you can get a solution that covers all scenarios. In terms of the SSL header injection overhead, it is just for the 3 login urls, when signing in to the service, so overhead is absolutely minimal.