May 09 2022 07:11 AM
Hello Techies!
I have poked around the issue for a while now, where I would like to limit access from iOS to unauthorized applications using Conditional Access policy but the native options leaves a lot to desire.
So not really able to use the portal to create a perfect whitelisted based app access I have also tried creating one through PowerShell but those results were mixed, it did appear in the portal but if someone were to open the policy in portal the content would disappear and the applicability of that policy was not exactly foolproof.
Sources for the CLI approach:
Any ideas how to approach it or if it is even reasonable/feasible?
Example 1: A good result could be that Intune, Teams and SharePoint is allowed (along with MS required components) and rest of the not approved apps would error out.
Example 2: OR a blacklist where all admin portal are disabled (for example did not find a way to block Microsoft Office 365 Portal)
Both black and whitelist approaches are missing some key apps that really defeat the whole point.
May 09 2022 07:45 AM
May 09 2022 07:55 AM
Thanks for the reply Niels!
I think you got the gist of the plan. Regarding RBAC, it would only help if users do not have a license, in my case they do but we want to limit access from iOS entirely.
Here is an example of the potential policy.
Unfortunately not all needed apps can be whitelisted 😞 (at least via GUI)
May 10 2022 12:42 AM
May 10 2022 04:19 AM - edited May 10 2022 04:21 AM
hi @Alo Press
for example 1 you can take a look at app protection policies (mam)
example 2
To block access to portals, you have to use different solutions and configurations. E.g., you can block the azure ad portal for normal users. This is a builtin configuration setting in azure ad.
To block access for instance the endpoint portal you can use Defender for cloud apps in combination with conditional access.
https://docs.microsoft.com/en-us/defender-cloud-apps/what-is-defender-for-cloud-apps
note. Defender for cloud apps is only applicable in the browser.
Kind regards,
rene
May 10 2022 11:49 PM