Skip to content

Commit 0a54607

Browse files
v-edmckillopv-edmckillop
authored
Update 7-secure-access-conditional-access.md
1 parent 99773e0 commit 0a54607

File tree

1 file changed

+61
-48
lines changed

1 file changed

+61
-48
lines changed

‎articles/active-directory/fundamentals/7-secure-access-conditional-access.md

Lines changed: 61 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -55,12 +55,11 @@ Learn more:
5555
* [Manage Azure Active Directory groups and group membership](how-to-manage-groups.md)
5656
* [Overview of Microsoft 365 Groups for administrators](/microsoft-365/admin/create-groups/office-365-groups?view=o365-worldwide&preserve-view=true)
5757

58-
5958
### Conditional Access policy creation
6059

61-
Create as few Conditional Access policies as possible. For applications that have the same access needs, add them all to the same policy.
60+
Create as few Conditional Access policies as possible. For applications that have the same access requirements, add them to the same policy.
6261

63-
Conditional Access policies can apply to a maximum of 250 applications. If more than 250 Apps have the same access needs, create duplicate policies. Policy A will apply to apps 1-250, policy B will apply to apps 251-500, etc.
62+
Conditional Access policies apply to a maximum of 250 applications. If more than 250 applications have the same access requirement, create duplicate policies. For instance, Policy A applies to apps 1-250, Policy B applies to apps 251-500, etc.
6463

6564
### Naming convention
6665

@@ -73,51 +72,65 @@ Use a naming convention that clarifies policy purpose. External access examples
7372

7473
You can block external users from accessing resources with Conditional Access policies.
7574

76-
Sign in to the **Azure portal** as a Conditional Access Administrator, Security Administrator, or Global Administrator.
77-
Browse to **Azure Active Directory** > **Security** > **Conditional Access**.
78-
Select **New policy**.
79-
Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies, for example ExternalAccess_Block_FinanceApps.
80-
Under **Assignments**, select **Users or workload identities**.
81-
Under **Include**, select **All guests and external users**.
82-
Under **Exclude**, select **Users and groups** and choose your organization's [emergency access or break-glass accounts](../roles/security-emergency-access.md).
83-
Select **Done**.
84-
Under **Cloud apps or actions** > **Include**, select **All cloud apps**.
85-
Under **Exclude**, select any applications that shouldn’t be blocked.
86-
Under **Access controls** > **Grant**, select **Block access**, and choose **Select**.
87-
Confirm your settings and set **Enable policy** to **Report-only**.
88-
Select **Create** to create to enable your policy.
89-
90-
After confirming your settings using [report-only mode](../conditional-access/howto-conditional-access-insights-reporting.md), an administrator can move the **Enable policy** toggle from **Report-only** to **On**.
91-
92-
### Block external access to all except specific external users
93-
94-
There may be times you want to block external users except a specific group. For example, you may want to block all external users except those working for the finance team from the finance applications. To do this [Create a security group](active-directory-groups-create-azure-portal.md) to contain the external users who should access the finance applications:
95-
96-
Sign in to the **Azure portal** as a Conditional Access Administrator, Security Administrator, or Global Administrator.
97-
Browse to **Azure Active Directory** > **Security** > **Conditional Access**.
98-
Select **New policy**.
99-
Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies, for example ExternalAccess_Block_AllButFinance.
100-
Under **Assignments**, select **Users or workload identities**.
101-
Under **Include**, select **All guests and external users**.
102-
Under **Exclude**, select **Users and groups**,
103-
Choose your organization's [emergency access or break-glass accounts](../roles/security-emergency-access.md).
104-
Choose the security group of external users you want to exclude from being blocked from specific applications.
105-
Select **Done**.
106-
Under **Cloud apps or actions** > **Include**, select **All cloud apps**.
107-
Under **Exclude**, select the finance applications that shouldn’t be blocked.
108-
Under **Access controls** > **Grant**, select **Block access**, and choose **Select**.
109-
Confirm your settings and set **Enable policy** to **Report-only**.
110-
Select **Create** to create to enable your policy.
111-
112-
After confirming your settings using [report-only mode](../conditional-access/howto-conditional-access-insights-reporting.md), an administrator can move the **Enable policy** toggle from **Report-only** to **On**.
113-
114-
### External partner access
115-
116-
Conditional Access policies that target external users may interfere with service provider access, for example granular delegated admin privileges [Introduction to granular delegated admin privileges (GDAP)](/partner-center/gdap-introduction).
117-
118-
## Implement Conditional Access
119-
120-
Many common Conditional Access policies are documented. See the article [Common Conditional Access policies](../conditional-access/concept-conditional-access-policy-common.md) for other common policies you may want to adapt for external users.
75+
1. Sign in to the Azure portal as a Conditional Access Administrator, Security Administrator, or Global Administrator.
76+
2. Browse to **Azure Active Directory** > **Security** > **Conditional Access**.
77+
3. Select **New policy**.
78+
4. Enter a policy a name.
79+
5. Under **Assignments**, select **Users or workload identities**.
80+
6. Under **Include**, select **All guests and external users**.
81+
7. Under **Exclude**, select **Users and groups**.
82+
8. Select emergency access accounts.
83+
9. Select **Done**.
84+
10. Under **Cloud apps or actions** > **Include**, select **All cloud apps**.
85+
11. Under **Exclude**, select applications that shouldn’t be blocked.
86+
12. Under **Access controls** > **Grant**, select **Block access**.
87+
13. Select **Select**.
88+
14. Select **Enable policy** to **Report-only**.
89+
15. Select **Create**.
90+
91+
> [!NOTE]
92+
> You can confirm settings in **report only** mode. See, Configure a Conditional Access policy in repory-only mode, in [Conditional Access insights and reporting](../conditional-access/howto-conditional-access-insights-reporting.md).
93+
94+
Learn more: [Manage emergency access accounts in Azure AD](../roles/security-emergency-access.md)
95+
96+
### Allow external access to specific external users
97+
98+
There are scenarios when it's necessary to allow access for a small, specific group.
99+
100+
Before you begin, you can create a security group, which contains external users who access resources. See, [Quickstart: Create a group with members and view all groups and members in Azure Active Directory](active-directory-groups-view-azure-portal).
101+
102+
1. Sign in to the Azure portal as a Conditional Access Administrator, Security Administrator, or Global Administrator.
103+
2. Browse to **Azure Active Directory** > **Security** > **Conditional Access**.
104+
3. Select **New policy**.
105+
4. Enter a policy name.
106+
5. Under **Assignments**, select **Users or workload identities**.
107+
6. Under **Include**, select **All guests and external users**.
108+
7. Under **Exclude**, select **Users and groups**
109+
8. Select emergency access accounts.
110+
9. Select the external users security group.
111+
10. Select **Done**.
112+
11. Under **Cloud apps or actions** > **Include**, select **All cloud apps**.
113+
12. Under **Exclude**, select the applications that shouldn’t be blocked.
114+
13. Under **Access controls** > **Grant**, select **Block access**.
115+
14. Select **Select**.
116+
15. Select **Create**.
117+
118+
> [!NOTE]
119+
> You can confirm settings in **report only** mode. See, Configure a Conditional Access policy in repory-only mode, in [Conditional Access insights and reporting](../conditional-access/howto-conditional-access-insights-reporting.md).
120+
121+
Learn more: [Manage emergency access accounts in Azure AD](../roles/security-emergency-access.md)
122+
123+
### Service provider access
124+
125+
Conditional Access policies for external users might interfere with service provider access, for example granular delegated administrate privileges.
126+
127+
Learn more: [Introduction to granular delegated admin privileges (GDAP)](/partner-center/gdap-introduction)
128+
129+
## Conditional Access templates
130+
131+
Conditional Access templates are a convenient method to deploy new policies aligned with Microsoft recommendations. These templates provide protection aligned with commonly used policies across various customer types and locations.
132+
133+
Learn more: [Conditional Access templates (Preview)](../conditional-access/concept-conditional-access-policy-common.md)
121134

122135
## Next steps
123136

0 commit comments

Comments
 (0)