Nov 20 2018 06:30 AM
Nov 20 2018 06:30 AM
Fairly new to Conditional Access.
I have a scenario where we want to stop users accessing Office 365 applications if they are coming in from an external connection and don't have a certificate present issued by our internal PKI.
Is there a policy that we can configure in conditional access that says:
I am coming in from an external connection, look for a user/computer certificate on this device (be that laptop or mobile) and if present allow access. If not present, block access.
Primarily the goal is to stop users accessing Office 365 from non corporate, external devices.
This seems to fit the bill: https://docs.microsoft.com/en-gb/cloud-app-security/proxy-deployment-aad am I on the right track here? Could configure an app control policy for Office 365, and add a device control/tag to specify a valid client certificate is required?
Nov 21 2018 02:27 PM
You are exactly right. You can create an Azure AD conditional access policy that routes traffic to Cloud App Security. In Cloud App Security, you would then upload the root or intermediate cert, and create an access policy that has:
The following conditions:
Device tag | does not equal | Valid client certificate
App | [relevant applications go here]
IP address | category | does not equal | Corporate
The resulting controls:
If you need help with this, feel free to reach me at email@example.com
May 24 2019 08:13 AM
I've tried implementing this with absolutely no success whatsoever. I've put out internal and root certificate in MCAS. Created my conditional access policy. I can see alerts from my policy so I know the conditional access policy is running and the policy is triggered. But it seems MCAS is simply unable to make any certificate comparison so just blocks everything. Certificate or no certificate. There seems little detail on this. Which browsers are supported? Should it prompt when attempting to verify the certificate?
Apr 16 2020 12:50 PM
Hi folks, it would be super helpful to get a support case number so I can track it with the team. You can reach out to me at firstname.lastname@example.org if you need help with this.
In general, the docs cover Client-Certificate Authenticated Devices in quite some detail here: https://docs.microsoft.com/en-us/cloud-app-security/proxy-intro-aad#managed-device-identification
If you feel like this is missing explicit content, please let me know and we can work to update it.
Apr 17 2020 06:21 AM
Apr 17 2020 08:25 AM
@Ru we have this working. You have to use a user certificate that the user cannot export and not a machine certificate. Another thing to watch for is the user experience through different browers. the browser will prompt for a certificate (except Firefox which will just block). Put the MCAS redirect url in trusted sites and ensure browser settings do not prompt for a certificate.
Apr 23 2020 11:54 PM
Apr 24 2020 02:16 AM - edited Apr 24 2020 02:19 AM
@Schebby The redirect is the path appended by MCAS reverse proxy. So dependent on your region (mine is EU) the url looks like this and you can see in the address bar when MCAS adds it when visiting the address under certificate control.
So you add for example *.eu.access-control.cas.ms to the trusted sites zone. And yes you enable the setting in that zone for "do not prompt for a cert".
May 01 2020 10:43 AM
@Kevin Spreadbury I figured it out (with help from support)! It wasn't trusted sites or AutoSelectCertificateForUrls (on Chrome/Edge (Chromium) side) at all (although I had already set that per your guidance). It was that I didn't have a client cert in the local user cert store. Apparently, (on Win10 at least) the browsers won't look in the local machine cert store for client (identity) certs. I wasn't being prompted because nothing was available for the browsers to show. Once I added a cert to the local user cert store, it immediately started prompting (and working).
Hope this helps others...
May 04 2020 01:00 AM
@Schebby Hi, yes correct hence my comment above it needs to be a user certificate and not a machine certificate. You'll also need to ensure the certificate is not exportable by the user of course.