Control the Application behavior within the organization network

[dilanmic]

Hi All,

one of my client is having below concerns and wanted to know whether these would be possible scenarios.

1)  Can we block user from accessing to Shared drive and RDP within Organization's network through Conditional access policy or any other way? if user is outside of Organization's network this would be allowed. 

2)  Can we control on-premises application like SAP through Conditional Access policy or any other way? Please note application does have a web URL.

Thanks in advance

Dilan

[#2 · Accepted solution]

Could you elaborate on what the goals are?

1) Where are these shared drives and servers? Are they managed by the company?
Conditional access only works on applications and resources that use Azure AD. Resources can be both on-premise and in the cloud, but this does not work with regular file servers and RDP access.
This would normally be managed via firewalls and local/domain authentication.
If you want to block RDP to resources outside of the company network, I would block 3389 in the firewall.
If you want to block access to shared drives such as Box or Dropbox, I would block this with a proxy or firewall.

2) You can extend conditional access to on-premises applications by using Azure AD Application Proxy.
https://learn.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy

[#3]

Thank you very much!

Just wanted to double confirm, Can we use Azure AD Application Proxy for On-premises application which doesn't have URL access. my client is using just a installed application.

thanks again,
Dilan

[#4]

Pretty sure a URL is required.
https://learn.microsoft.com/en-us/azure/active-directory/app-proxy/what-is-application-proxy

Also, should have mentioned this, but as is mentioned in the link I sent you, App Proxy is meant to enable safe remote access to on-premises applications, and is not for accessing internal applications from the internal network.
"It's important to understand that Azure AD Application Proxy is intended as a VPN or reverse proxy replacement for roaming (or remote) users who need access to internal resources. It's not intended for internal users on the corporate network. Internal users who unnecessarily use Application Proxy can introduce unexpected and undesirable performance issues."

[#5]

Thank you very much.
In this case, Azure AD proxy is not the good solution for my client, since they doesn't have URL access for the application and again purpose of this implementing is they want to control the application login behavior by end users such as only allowed applications can be access within the internal networks. Among those applications, they have SAP application which is Onprem application.