Merge pull request #205026 from MicrosoftGuyJFlo/ConditionAccessChangesPG

[Azure AD] Conditional Access - All cloud apps

Author: v-dirichards

articles/active-directory/conditional-access/concept-conditional-access-cloud-apps.md

@@ -6,7 +6,7 @@ services: active-directory
 ms.service: active-directory
 ms.subservice: conditional-access
 ms.topic: conceptual
-ms.date: 04/19/2022
+ms.date: 07/18/2022
 
 ms.author: joflore
 author: MicrosoftGuyJFlo
@@ -101,7 +101,7 @@ The following key applications are included in the Office 365 client app:
 - OneDrive
 - Power Apps
 - Power Automate
-- Security & Compliance Center
+- Security & compliance portal
 - SharePoint Online
 - Skype for Business Online
 - Skype and Teams Tenant Admin API
@@ -112,30 +112,35 @@ A complete list of all services included can be found in the article [Apps inclu
 
 ### Microsoft Azure Management
 
-The Microsoft Azure Management application includes multiple services. 
-
-   - Azure portal
-   - Microsoft Entra admin center
-   - Azure Resource Manager provider
-   - Classic deployment model APIs
-   - Azure PowerShell
-   - Azure CLI
-   - Azure DevOps
-   - Azure Data Factory portal
-   - Azure Event Hubs
-   - Azure Service Bus
-   - [Azure SQL Database](/azure/azure-sql/database/conditional-access-configure)
-   - SQL Managed Instance
-   - Azure Synapse
-   - Visual Studio subscriptions administrator portal
+When Conditional Access policy is targeted to the Microsoft Azure Management application, within the Conditional Access policy app picker the policy will be enforced for tokens issued to application IDs of a set of services closely bound to the portal.  
+
+- Azure Resource Manager
+- Azure portal, which also covers the Microsoft Entra admin center                                                          
+- Azure Data Lake                                                
+- Application Insights API                              
+- Log Analytics API                                         
+
+Because the policy is applied to the Azure management portal and API, services, or clients with an Azure API service dependency, can indirectly be impacted. For example: 
+
+- Classic deployment model APIs 
+- Azure PowerShell 
+- Azure CLI 
+- Azure DevOps 
+- Azure Data Factory portal 
+- Azure Event Hubs 
+- Azure Service Bus 
+- [Azure SQL Database](/azure/azure-sql/database/conditional-access-configure)
+- SQL Managed Instance 
+- Azure Synapse 
+- Visual Studio subscriptions administrator portal 
 
 > [!NOTE]
 > The Microsoft Azure Management application applies to [Azure PowerShell](/powershell/azure/what-is-azure-powershell), which calls the [Azure Resource Manager API](../../azure-resource-manager/management/overview.md). It does not apply to [Azure AD PowerShell](/powershell/azure/active-directory/overview), which calls the [Microsoft Graph API](/graph/overview).
 
 For more information on how to set up a sample policy for Microsoft Azure Management, see [Conditional Access: Require MFA for Azure management](howto-conditional-access-policy-azure-management.md).
 
->[!NOTE]
->For Azure Government, you should target the Azure Government Cloud Management API application.
+> [!TIP]
+> For Azure Government, you should target the Azure Government Cloud Management API application.
 
 ### Other applications
 
@@ -150,7 +155,23 @@ Administrators can add any Azure AD registered application to Conditional Access
 > [!NOTE]
 > Since Conditional Access policy sets the requirements for accessing a service you are not able to apply it to a client (public/native) application. In other words, the policy is not set directly on a client (public/native) application, but is applied when a client calls a service. For example, a policy set on SharePoint service applies to the clients calling SharePoint. A policy set on Exchange applies to the attempt to access the email using Outlook client. That is why client (public/native) applications are not available for selection in the Cloud Apps picker and Conditional Access option is not available in the application settings for the client (public/native) application registered in your tenant. 
 
-Some applications don't appear in the picker at all. The only way to include these applications in a Conditional Access policy is to include **All apps**. 
+Some applications don't appear in the picker at all. The only way to include these applications in a Conditional Access policy is to include **All cloud apps**. 
+
+### All cloud apps
+
+Applying a Conditional Access policy to **All cloud apps** will result in the policy being enforced for all tokens issued to web sites and services. This option includes applications that aren't individually targetable in Conditional Access policy, such as Azure Active Directory. 
+
+In some cases, an **All cloud apps** policy could inadvertently block user access. These cases are excluded from policy enforcement and include:
+
+- Services required to achieve the desired security posture. For example, device enrollment calls are excluded from compliant device policy targeted to All cloud apps. 
+
+- Calls to Azure AD Graph and MS Graph, to access user profile, group membership and relationship information that is commonly used by applications excluded from policy. The excluded scopes are listed below. Consent is still required for apps to use these permissions. 
+   - For native clients:
+      - Azure AD Graph: User.read
+      - MS Graph: User.read, People.read, and UserProfile.read 
+   - For confidential / authenticated clients:
+      - Azure AD Graph: User.read, User.read.all, and User.readbasic.all
+      - MS Graph: User.read,User.read.all, User.read.All People.read, People.read.all, GroupMember.Read.All, Member.Read.Hidden, and UserProfile.read 
 
 ## User actions
 

articles/active-directory/conditional-access/concept-conditional-access-grant.md

@@ -69,6 +69,8 @@ Devices must be registered in Azure AD before they can be marked as compliant. M
 > [!NOTE]
 > On Windows 7, iOS, Android, macOS, and some third-party web browsers Azure AD identifies the device using a client certificate that is provisioned when the device is registered with Azure AD. When a user first signs in through the browser the user is prompted to select the certificate. The end user must select this certificate before they can continue to use the browser.
 
+You can use the Microsoft Defender for Endpoint app along with the Approved Client app policy in Intune to set device compliance policy Conditional Access policies. There's no exclusion required for the Microsoft Defender for Endpoint app while setting up Conditional Access. Although Microsoft Defender for Endpoint on Android & iOS  (App ID - dd47d17a-3194-4d86-bfd5-c6ae6f5651e3) isn't an approved app, it has permission to report device security posture. This permission enables the flow of compliance information to Conditional Access.
+
 ### Require hybrid Azure AD joined device
 
 Organizations can choose to use the device identity as part of their Conditional Access policy. Organizations can require that devices are hybrid Azure AD joined using this checkbox. For more information about device identities, see the article [What is a device identity?](../devices/overview.md).