Block user access to Azure AD Powershell with Conditional Access

[Ottovw]

I can't find any way to block access to Azure AD PowerShell with Conditional Access policy. For normal users without any Azure AD role, it's possible to read other user information in Azure AD PowerShell. There is a Cloud app Microsoft Azure Management which can be used for Conditional Access policy, but is not including Azure AD PowerShell. 

So I try to enable at least MFA for the use of Azure AD PowerShell to downscale the security risks (compromised accounts and reconnaissance) but, I have the same problems. It seems impossible to enforce MFA and PowerShell without the use of global Azure AD setting “Enable Security Defaults” enabled. When enabled (test tenant) it's enforcing MFA when trying to connect to Azure AD PowerShell. However, the use of Conditional Access policies is more desirable for better control and therefore the security defaults are not applicable. 

I have also find this: 

Set-MsolCompanySettings -UsersPermissionToReadOtherUsersEnabled $false

But this results in problems in Teams and Planner: users will not able to add new members.

Any ideas? 

[#2 · Accepted solution]

@Ottovw 

I've had the same trouble you've had.  However, there is a way to block this via conditional access policies.  As luck would have it, we have a report only policy that blocks most things for testing purposes.  Looking at Azure logs I could see that if we had enabled that policy we would have triggered azure active directory powershell and it would have blocked it!  So what I did was I created a policy that included all cloud apps and then just excluded the ones we use in our other policies (which were a few) and boom... MFA prompted.  It seems that the azure active directory is in the enterprise apps (as you can do searches and see logs on activity) but its "hidden".  There might be a way to powershell it since i can find an application ID, but thats down the line.

Hope that helps.  Godspeed

[#3]

Thank you for your reaction! It's for now the best solution. I hope Microsoft will add a dedicated conditional access policies for Azure AD Powershell in the near future.

[#4]

Hello, the Microsoft Azure Management application applies to Azure PowerShell, which calls the Azure Resource Manager API. As you noticed it does not apply to Azure AD PowerShell, which calls Microsoft Graph.

As mentioned above the way to go is instead the "except approach" where you only add those apps/services in CA that should work, and also usually for externals.

[#5]

@Ottovw You can block Azure AD Powershell via Conditional Access policy, but not in GUI. You need to create policy via Powershell and API.

it is working for me:

https://call4cloud.nl/2020/11/the-conditional-access-experiment/