You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
|inputClaim| inputClaim | boolean | The ClaimType to be asserted. |
119
+
|InputClaim| inputClaim | boolean | The ClaimType to be asserted. |
120
120
| InputParameter |valueToCompareTo | boolean | The value to compare (true or false). |
121
-
| OutputClaim |inputClaim| boolean | The ClaimType that is produced after this ClaimsTransformation has been invoked. |
121
+
| OutputClaim |compareResult| boolean | The ClaimType that is produced after this ClaimsTransformation has been invoked. |
122
122
123
123
124
124
The following claims transformation demonstrates how to check the value of a boolean ClaimType with a `true` value. If the value of the `IsAgeOver21Years` ClaimType is equal to `true`, the claims transformation returns `true`, otherwise `false`.
Copy file name to clipboardExpand all lines: articles/active-directory/conditional-access/block-legacy-authentication.md
+19-2Lines changed: 19 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ services: active-directory
6
6
ms.service: active-directory
7
7
ms.subservice: conditional-access
8
8
ms.topic: conceptual
9
-
ms.date: 11/21/2019
9
+
ms.date: 02/25/2020
10
10
11
11
ms.author: joflore
12
12
author: MicrosoftGuyJFlo
@@ -45,13 +45,30 @@ Conditional Access policies are enforced after the first-factor authentication h
45
45
46
46
This section explains how to configure a Conditional Access policy to block legacy authentication.
47
47
48
+
### Legacy authentication protocols
49
+
50
+
The following options are considered legacy authentication protocols
51
+
52
+
- Authenticated SMTP - Used by POP and IMAP client's to send email messages.
53
+
- Autodiscover - Used by Outlook and EAS clients to find and connect to mailboxes in Exchange Online.
54
+
- Exchange Online PowerShell - Used to connect to Exchange Online with remote PowerShell. If you block Basic authentication for Exchange Online PowerShell, you need to use the Exchange Online PowerShell Module to connect. For instructions, see [Connect to Exchange Online PowerShell using multi-factor authentication](https://docs.microsoft.com/powershell/exchange/exchange-online/connect-to-exchange-online-powershell/mfa-connect-to-exchange-online-powershell).
55
+
- Exchange Web Services (EWS) - A programming interface that's used by Outlook, Outlook for Mac, and third-party apps.
56
+
- IMAP4 - Used by IMAP email clients.
57
+
- MAPI over HTTP (MAPI/HTTP) - Used by Outlook 2010 and later.
58
+
- Offline Address Book (OAB) - A copy of address list collections that are downloaded and used by Outlook.
59
+
- Outlook Anywhere (RPC over HTTP) - Used by Outlook 2016 and earlier.
60
+
- Outlook Service - Used by the Mail and Calendar app for Windows 10.
61
+
- POP3 - Used by POP email clients.
62
+
- Reporting Web Services - Used to retrieve report data in Exchange Online.
63
+
- Other clients - Other protocols identified as utilizing legacy authentication.
64
+
48
65
### Identify legacy authentication use
49
66
50
67
Before you can block legacy authentication in your directory, you need to first understand if your users have apps that use legacy authentication and how it affects your overall directory. Azure AD sign-in logs can be used to understand if you’re using legacy authentication.
51
68
52
69
1. Navigate to the **Azure portal** > **Azure Active Directory** > **Sign-ins**.
53
70
1. Add the Client App column if it is not shown by clicking on **Columns** > **Client App**.
54
-
1.**Add filters** > **Client App** > select all of the options for **Other clients** and click **Apply**.
71
+
1.**Add filters** > **Client App** > select all of the legacy authentication protocols, and click **Apply**.
55
72
56
73
Filtering will only show you sign-in attempts that were made by legacy authentication protocols. Clicking on each individual sign-in attempt will show you additional details. The **Client App** field under the **Basic Info** tab will indicate which legacy authentication protocol was used.
Copy file name to clipboardExpand all lines: articles/active-directory/conditional-access/concept-conditional-access-conditions.md
+16-3Lines changed: 16 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -49,7 +49,9 @@ When configuring location as a condition, organizations can choose to include or
49
49
50
50
When including **any location**, this option includes any IP address on the internet not just configured named locations. When selecting **any location**, administrators can choose to exclude **all trusted** or **selected locations**.
51
51
52
-
For example, some organizations may choose to not require multi-factor authentication when their users are connected to the network in a trusted location such as their physical headquarters. Administrators could create a policy that includes any location but excludes the selected locations for their headquarters networks
52
+
For example, some organizations may choose to not require multi-factor authentication when their users are connected to the network in a trusted location such as their physical headquarters. Administrators could create a policy that includes any location but excludes the selected locations for their headquarters networks.
53
+
54
+
More information about locations can be found in the article, [What is the location condition in Azure Active Directory Conditional Access](location-condition.md).
53
55
54
56
## Client apps (preview)
55
57
@@ -64,7 +66,18 @@ Conditional Access policies by default apply to browser-based applications and a
64
66
- By default this includes all use of the Exchange ActiveSync (EAS) protocol. Choosing **Apply policy only to supported platforms** will limit to supported platforms like iOS, Android, and Windows.
65
67
- When policy blocks the use of Exchange ActiveSync the affected user will receive a single quarantine email. This email with provide information on why they are blocked and include remediation instructions if able.
66
68
- Other clients
67
-
- This option includes clients that use basic/legacy authentication protocols including IMAP, MAPI, POP, SMTP, and legacy Office applications that do not support modern authentication.
69
+
- This option includes clients that use basic/legacy authentication protocols that do not support modern authentication.
70
+
- Authenticated SMTP - Used by POP and IMAP client's to send email messages.
71
+
- Autodiscover - Used by Outlook and EAS clients to find and connect to mailboxes in Exchange Online.
72
+
- Exchange Online PowerShell - Used to connect to Exchange Online with remote PowerShell. If you block Basic authentication for Exchange Online PowerShell, you need to use the Exchange Online PowerShell Module to connect. For instructions, see [Connect to Exchange Online PowerShell using multi-factor authentication](https://docs.microsoft.com/powershell/exchange/exchange-online/connect-to-exchange-online-powershell/mfa-connect-to-exchange-online-powershell).
73
+
- Exchange Web Services (EWS) - A programming interface that's used by Outlook, Outlook for Mac, and third-party apps.
74
+
- IMAP4 - Used by IMAP email clients.
75
+
- MAPI over HTTP (MAPI/HTTP) - Used by Outlook 2010 and later.
76
+
- Offline Address Book (OAB) - A copy of address list collections that are downloaded and used by Outlook.
77
+
- Outlook Anywhere (RPC over HTTP) - Used by Outlook 2016 and earlier.
78
+
- Outlook Service - Used by the Mail and Calendar app for Windows 10.
79
+
- POP3 - Used by POP email clients.
80
+
- Reporting Web Services - Used to retrieve report data in Exchange Online.
68
81
69
82
These conditions are commonly used when requiring a managed device, blocking legacy authentication, and blocking web applications but allowing mobile or desktop apps.
70
83
@@ -137,7 +150,7 @@ This setting has an impact on access attempts made from the following mobile app
137
150
| Outlook 2016, Outlook 2013 (with modern authentication), Skype for Business (with modern authentication) | Office 365 Exchange Online | Windows 8.1, Windows 7 |
138
151
| Outlook mobile app | Office 365 Exchange Online | Android, iOS |
139
152
| Power BI app | Power BI service | Windows 10, Windows 8.1, Windows 7, Android, and iOS |
140
-
| Skype for Business | Office 365 Exchange Online| Android, IOS|
153
+
| Skype for Business | Office 365 Exchange Online| Android, iOS|
141
154
| Visual Studio Team Services app | Visual Studio Team Services | Windows 10, Windows 8.1, Windows 7, iOS, and Android |
Copy file name to clipboardExpand all lines: articles/active-directory/conditional-access/controls.md
+7-92Lines changed: 7 additions & 92 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,106 +1,21 @@
1
1
---
2
-
title: Access controls in Azure Active Directory Conditional Access
3
-
description: Learn how access controls in Azure Active Directory Conditional Access work.
2
+
title: Custom controls in Azure AD Conditional Access
3
+
description: Learn how custom controls in Azure Active Directory Conditional Access work.
4
4
5
5
services: active-directory
6
6
ms.service: active-directory
7
7
ms.subservice: conditional-access
8
8
ms.topic: article
9
-
ms.date: 12/20/2019
9
+
ms.date: 02/25/2020
10
10
11
11
ms.author: joflore
12
12
author: MicrosoftGuyJFlo
13
13
manager: daveba
14
14
ms.reviewer: calebb
15
15
16
-
#Customer intent: As an IT admin, I need to understand the controls in Conditional Access so that I can set them according to my business needs
17
16
ms.collection: M365-identity-device-management
18
17
---
19
-
# What are access controls in Azure Active Directory Conditional Access?
20
-
21
-
With [Azure Active Directory (Azure AD) Conditional Access](../active-directory-conditional-access-azure-portal.md), you can control how authorized users access your cloud apps. In a Conditional Access policy, you define the response ("do this") to the reason for triggering your policy ("when this happens").
22
-
23
-
24
-
25
-
In the context of Conditional Access,
26
-
27
-
- "**When this happens**" is called **conditions**
28
-
- "**Then do this**" is called **access controls**
29
-
30
-
The combination of a condition statement with your controls represents a Conditional Access policy.
31
-
32
-
33
-
34
-
Each control is either a requirement that must be fulfilled by the person or system signing in, or a restriction on what the user can do after signing in.
35
-
36
-
There are two types of controls:
37
-
38
-
-**Grant controls** - To gate access
39
-
-**Session controls** - To restrict access within a session
40
-
41
-
This topic explains the various controls that are available in Azure AD Conditional Access.
42
-
43
-
## Grant controls
44
-
45
-
With grant controls, you can either block access altogether or allow access with additional requirements by selecting the desired controls. For multiple controls, you can require:
46
-
47
-
- All selected controls to be fulfilled (*AND*)
48
-
- One selected control to be fulfilled (*OR*)
49
-
50
-
51
-
52
-
### Multi-factor authentication
53
-
54
-
You can use this control to require multi-factor authentication to access the specified cloud app. This control supports the following multi-factor providers:
55
-
56
-
- Azure Multi-Factor Authentication
57
-
- An on-premises multi-factor authentication provider, combined with Active Directory Federation Services (AD FS).
58
-
59
-
Using multi-factor authentication helps protect resources from being accessed by an unauthorized user who might have gained access to the primary credentials of a valid user.
60
-
61
-
### Compliant device
62
-
63
-
You can configure Conditional Access policies that are device-based. The objective of a device-based Conditional Access policy is to only grant access to the selected cloud apps from [managed devices](require-managed-devices.md). Requiring a device to be marked as compliant is one option you have to limit access to managed devices. A device can be marked as compliant by Intune (for any device OS) or by your third-party MDM system for Windows 10 devices. Third-party MDM systems for device OS types other than Windows 10 are not supported.
64
-
65
-
Your device needs to be registered to Azure AD before it can be marked as compliant. To register a device, you have three options:
66
-
67
-
- Azure AD registered devices
68
-
- Azure AD joined devices
69
-
- Hybrid Azure AD joined devices
70
-
71
-
These three options are discussed in the article [What is a device identity?](../devices/overview.md)
72
-
73
-
For more information, see [how to require managed devices for cloud app access with Conditional Access](require-managed-devices.md).
74
-
75
-
### Hybrid Azure AD joined device
76
-
77
-
Requiring a hybrid Azure AD joined device is another option you have to configure device-based Conditional Access policies. This requirement refers to Windows desktops, laptops, and enterprise tablets that are joined to an on-premises Active Directory. If this option is selected, your Conditional Access policy grants access to access attempts made with devices that are joined to your on-premises Active Directory and your Azure Active Directory. Mac devices do not support hybrid Azure AD join.
78
-
79
-
For more information, see [set up Azure Active Directory device-based Conditional Access policies](require-managed-devices.md).
80
-
81
-
### Approved client app
82
-
83
-
Because your employees use mobile devices for both personal and work tasks, you might want to have the ability to protect company data accessed using devices even in the case where they are not managed by you.
84
-
You can use [Intune app protection policies](https://docs.microsoft.com/intune/app-protection-policy) to help protect your company’s data independent of any mobile-device management (MDM) solution.
85
-
86
-
With approved client apps, you can require a client app that attempts to access your cloud apps to support [Intune app protection policies](https://docs.microsoft.com/intune/app-protection-policy). For example, you can restrict access to Exchange Online to the Outlook app. A Conditional Access policy that requires approved client apps is also known as [app-based Conditional Access policy](app-based-conditional-access.md). For a list of supported approved client apps, see [approved client app requirement](concept-conditional-access-grant.md#require-approved-client-app).
87
-
88
-
### App protection policy (preview)
89
-
90
-
Because your employees use mobile devices for both personal and work tasks, you might want to have the ability to protect company data accessed using devices even in the case where they are not managed by you.
91
-
You can use [Intune app protection policies](https://docs.microsoft.com/intune/app-protection-policy) to help protect your company’s data independent of any mobile-device management (MDM) solution.
92
-
93
-
With app protection policy, you can limit access to client applications that have reported to Azure AD has having received [Intune app protection policies](https://docs.microsoft.com/intune/app-protection-policy). For example, you can restrict access to Exchange Online to the Outlook app that has an Intune app protection policy. A Conditional Access policy that requires app protection policy is also known as [app protection-based Conditional Access policy](concept-conditional-access-session.md#application-enforced-restrictions).
94
-
95
-
Your device must be registered to Azure AD before an application can be marked as policy protected.
96
-
97
-
For a list of supported policy protected client apps, see [app protection policy requirement](concept-conditional-access-session.md#application-enforced-restrictions).
98
-
99
-
### Terms of use
100
-
101
-
You can require a user in your tenant to consent to the terms of use before being granted access to a resource. As an administrator, you can configure and customize terms of use by uploading a PDF document. If a user falls in scope of this control access to an application is only granted if the terms of use have been agreed.
102
-
103
-
## Custom controls (preview)
18
+
# Custom controls (preview)
104
19
105
20
Custom controls are a capability of the Azure Active Directory Premium P1 edition. When using custom controls, your users are redirected to a compatible service to satisfy further requirements outside of Azure Active Directory. To satisfy this control, a user’s browser is redirected to the external service, performs any required authentication or validation activities, and is then redirected back to Azure Active Directory. Azure Active Directory verifies the response and, if the user was successfully authenticated or validated, the user continues in the Conditional Access flow.
106
21
@@ -121,7 +36,7 @@ Providers currently offering a compatible service include:
121
36
122
37
For more information on those services, contact the providers directly.
123
38
124
-
###Creating custom controls
39
+
## Creating custom controls
125
40
126
41
To create a custom control, you should first contact the provider that you wish to utilize. Each non-Microsoft provider has its own process and requirements to sign up, subscribe, or otherwise become a part of the service, and to indicate that you wish to integrate with Conditional Access. At that point, the provider will provide you with a block of data in JSON format. This data allows the provider and Conditional Access to work together for your tenant, creates the new control and defines how Conditional Access can tell if your users have successfully performed verification with the provider.
127
42
@@ -137,15 +52,15 @@ Clicking **New custom control**, opens a blade with a textbox for the JSON data
137
52
138
53
139
54
140
-
###Deleting custom controls
55
+
## Deleting custom controls
141
56
142
57
To delete a custom control, you must first ensure that it isn’t being used in any Conditional Access policy. Once complete:
143
58
144
59
1. Go to the Custom controls list
145
60
1. Click …
146
61
1. Select **Delete**.
147
62
148
-
###Editing custom controls
63
+
## Editing custom controls
149
64
150
65
To edit a custom control, you must delete the current control and create a new control with the updated information.
Copy file name to clipboardExpand all lines: articles/active-directory/conditional-access/what-if-tool.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ services: active-directory
6
6
ms.service: active-directory
7
7
ms.subservice: conditional-access
8
8
ms.topic: article
9
-
ms.date: 11/21/2019
9
+
ms.date: 02/25/2020
10
10
11
11
ms.author: joflore
12
12
author: MicrosoftGuyJFlo
@@ -96,7 +96,7 @@ You start an evaluation by clicking **What If**. The evaluation result provides
96
96
97
97
If [classic policies](policy-migration.md#classic-policies) exist for the selected cloud apps, an indicator is presented to you. By clicking the indicator, you are redirected to the classic policies page. On the classic policies page, you can migrate a classic policy or just disable it. You can return to your evaluation result by closing this page.
98
98
99
-
On the list of policies that apply to your selected user, you can also find a list of [grant controls](controls.md#grant-controls) and [session](controls.md#session-controls) controls your user must satisfy.
99
+
On the list of policies that apply to your selected user, you can also find a list of [grant controls](concept-conditional-access-grant.md) and [session controls](concept-conditional-access-session.md) your user must satisfy.
100
100
101
101
On the list of policies that don't apply to your user, you can and also find the reasons why these policies don't apply. For each listed policy, the reason represents the first condition that was not satisfied. A possible reason for a policy that is not applied is a disabled policy because they are not further evaluated.
0 commit comments