Can we restrict Users from accessing Office 365 (on Azure) from certain IP address?

[AravindKonda]

We are accessing office 365 Mailbox on Azure cloud from AWS Virtual Private cloud through OAUTH 2.0. How can we impose restriction to allow Office 365 is accesible from only IP Address range of AWS VPC?

[#2]

I meant certain IP addresses@AravindKonda 

[#3]

You either need to use Conditional Access (https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-...) or redirect the auth process to some external system (federation) and impose the restrictions there.

[#4]

Thanks Vasil. I doubt we have premium subscription to utilize conditional access. Can you share more details on option   "redirect the auth process to some external system (federation) and impose the restrictions there".

[#5]

Read here: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/whatis-fed

[#6]

Hi Vasil,

   As Office 365 is accessed from AWS VPC cloud , what IP addresses I need to provide while whitelisting IP address using conditional access of Azure Active Directory. I have with me details of AWS VPC CIDR , but CIDR range is private Ip addresses. I think I need to provide public IP addresses in AAD configuration , so what IP address from AWS I should be looking for?

[#7]

@Vasil Michev  Regarding conditinal access I went through documentation. When using location settings we can specify access requests from particular IP addresses  or countries to be blocked . This is what I found in documentation , is it possible to specify settings other way like to allow requests from only certain IP adddresses , if it comes from any other IP addresses (not specified) requests shuld be blocked.

[#8]

@Vasil Michev  I appreciate your valuable time in responding to my questions. We do have conditinal access feature. Our Application is registered to run as background service or daemon without a signed-in user. The application is accessed from AWS cloud through Oauth2.0 authentication. Can conditional access be still applied? 

[#9]

Conditional access doesnt apply to application logins, that's different from "user" access. Depending on the protocol your app is using, you might be able to restrict it via Client Access Rules: https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/client-access-rules/...

[#10]

@Vasil Michev  Thanks Vasil , I too found the same solution. Due to some reason, our team is not ready apply access rules at exchange level. Do we have any other alternative?

[#11]

Nothing within O365, you can certainly add some restrictions in the app itself though.