Forum Discussion

rossonero's avatar
rossonero
Copper Contributor
Nov 18, 2021

Cloud app security certificate

So I setup cloud app security thorugh this guide

https://chrisonsecurity.net/2021/06/24/conditional-access-using-certificates/

I am using mac and testet on machine where it first time ask for certificate for entering outlook. So work as it should

Do I however, go in afterwards and remove the certificates, I am afterwards still able to access outlook - also even I wait several hours. Should MCAS go in and block if the certificate is missing or is it only first time ?- because then it is not usable for us as we then cannot block devices if needed

1 Reply

  • JaredPoeppelman's avatar
    JaredPoeppelman
    Iron Contributor
    Dec 03, 2021
    CAAC feature cannot reliably support apps because not all apps use interactive sign-in flows, like browsers do. This is one example of why that is the case. If the app is not using an interactive sign-in flow based on 302 redirects (like browser-based SSO works), then the identity provider (usually Azure AD) is unable to redirect the client session to the session proxy. The result is that your session policy is ineffective for that client because the client is still talking directly to Exchange Online, not through the session proxy.

    This is discussed here: https://docs.microsoft.com/en-us/defender-cloud-apps/proxy-intro-aad#supported-apps-and-clients

Resources