Forum Discussion

Natalie Dellar's avatar
Natalie Dellar
Copper Contributor
Nov 20, 2018

Conditional Access using certificate from Internal PKI

Hi, Hi all, Fairly new to Conditional Access. I have a scenario where we want to stop users accessing Office 365 applications if they are coming in from an external connection and don't have...
Cloud App Security
Kevin Spreadbury's avatar
Kevin Spreadbury
Brass Contributor

I've tried implementing this with absolutely no success whatsoever. I've put out internal and root certificate in MCAS. Created my conditional access policy. I can see alerts from my policy so I know the conditional access policy is running and the policy is triggered. But it seems MCAS is simply unable to make any certificate comparison so just blocks everything. Certificate or no certificate. There seems little detail on this. Which browsers are supported? Should it prompt when attempting to verify the certificate?

Ru's avatar
Ru
MVP
Apr 14, 2020
Hey Kevin, did you ever get this fixed?
  • Kevin Spreadbury's avatar
    Kevin Spreadbury
    Brass Contributor
    Apr 17, 2020

    Ru we have this working. You have to use a user certificate that the user cannot export and not a machine certificate. Another thing to watch for is the user experience through different browers. the browser will prompt for a certificate (except Firefox which will just block). Put the MCAS redirect url in trusted sites and ensure browser settings do not prompt for a certificate.

    • Ru's avatar
      Ru
      MVP
      Apr 22, 2020
      Awesome, thanks for the tip.
    • Schebby's avatar
      Schebby
      Copper Contributor
      Apr 24, 2020
      Can you elaborate on the redirect URL? Is this what site we expect to prompt for a client cert?

      Also, “do not prompt for a cert”..Is this that setting that (more or less) says if there’s only one client cert go ahead and use it? And I’m assuming this is in the trusted sites zone settings?

      This is all working perfectly on macOS, but I can’t get it to ask for a cert on Win10. My Win10 devices with certs are going directly to the CAS proxy in the browser.
      • Kevin Spreadbury's avatar
        Kevin Spreadbury
        Brass Contributor
        Apr 24, 2020

        Schebby  The redirect is the path appended by MCAS reverse proxy. So dependent on your region (mine is EU) the url looks like this and you can see in the address bar when MCAS adds it when visiting the address under certificate control.

        eu.access-control.cas.ms

        So you add for example *.eu.access-control.cas.ms to the trusted sites zone. And yes you enable the setting in that zone for "do not prompt for a cert".

Resources