Allow MS Teams via Conditional Access but block other O365 Services

[shocko]

I have been asked to see if the following is possible:

• Allow access to MS teams from anywhere for Voice/Video (we disable chat, file sharing via policy in the MS Teams admin portal)
• Block access to Exchange Online, SharePoint Online, OneDrive etc. when accessed from outside our corporate IP range.

Conditional access would normally be the way to go as we have done this with things like 3rd party SAAS app but reading around service dependencies for the O365 service's here it seems that we cannot simply allow MS Teams only if we want teams to work and would need to allow Exchange Online. For example:

- I have a policy to block all SAAS applications integrated with AzureAD from remote access
- I have SAAS application I wish to allow to users off my corporate network so I add it as an exclusion to the policy

Now, is this application was MS teams, can I do this or would I need to make the Office 365 app available via conditional access ?


Am I correct in this thinking?

[#2]

You want to have it all open in some situations or always off? (EXO,OD etc)

[#3]

@shocko Hi, not sure what you're asking either but Teams are depending on those services. With no EXO there's no scheduling, with no SharePoint/OneDrive there's no file sharing etc. You can read more detailed info here.

How SharePoint and OneDrive interact with Microsoft Teams - Microsoft Teams | Microsoft Docs

How Exchange and Microsoft Teams interact - Microsoft Teams | Microsoft Docs

[#4]

Overall you can restrict usage like above but rather using licensing restrictions, policy settings and app policys

[#5]

All our users will use MS teams at some level either on-prem or remote so restricting using licensing is not an option.

[#6]

Perhaps I explained poorly so I have updated the original description of the problem.