Condition Access Question

[Vineet Arora]

Hi,

We have following business requirement.

Only the devices issued/approved by IT departmernt should be able to access SharePoint Online. How can we acheive this using conditional or compliance policies?

We don't have on prem AD.

Thanks,

[#2]

Hey Vineet,

I am aware of the following solution, there could be other options;

To find out if a device is issued by the org/is compliant you would need a MDM solution like Intunes to find this information.

Once this is done you could leverage the azure ad conditional access policies to regulate the access.

[#3]

Are your computers all Azure domain joined? I would say Conditional Access is your friend for this. Do you use Intune?

[#4]

Hi,

yes, we use EMS E3 (Intune and AD P1). 

Can you please suggest how to make it work - Steps?

Ideanlly, we want to have a workflow like below.

- Have a policy in place that allows only Azure AD joined machines to access SharePoint Online.

- Only Admins can join machines to Azure AD.

Thanks,

[#5]

If your machines are AAD joined or registered then you can create a condition access policy that defines the Who-What-How  and grants access for domain joined machines.

Who: What users do you want the policy to apply to or exclude

What: The services you wish for the policy to apply to

How: The method of accessing the service (app or web browser).

I hope that makes sense.

[#6]

Hi,

Thanks for your reply.

The "Require domain joined" setting doesn't work. It seems it applies to On prem domain joined only.

I am trying to use compliance condition. However, I don't want users to auto enroll. Only admin should be able to enroll.

Thanks.

[#7 · Accepted solution]

Hi,
The following article should help you set this up.

https://cloudblogs.microsoft.com/enterprisemobility/2017/03/09/conditional-access-limited-access-pol...

https://support.office.com/en-us/article/Control-access-from-unmanaged-devices-5ae550c4-bd20-4257-84...

Also, in order for 'Use App enforce restriction' session access control to work. You have to set your organization to 'First-Release' for everyone. This will then update the sharepoint admin center access control page to set controls for sharepoint online access.

Hope this helps!

[#8]

Hi Christopher,

SharePoint access control did the job! However, I still have following questions/doubts.

1. Why manually created conditional access policies were not working with same settings?

2. Now, since I have this in place & working. How can I restrict only the IT admins to have capability to join Azure AD? A user can still join his home PC to Azure AD and conditional policy will allow him to access SharePoint.

3. How will I make the same working for other apps? e.g. Exchange online.

Many thanks!