Merge pull request #205756 from ecfan/tenant-isolation

Azure Logic Apps: Add docs for tenant isolation

Author: v-stsavell

articles/logic-apps/block-connections-across-tenants.md

@@ -0,0 +1,91 @@
+---
+title: Block access from other tenants
+description: Block connections shared by other tenants in Azure Logic Apps.
+services: logic-apps
+ms.suite: integration
+ms.reviewer: estfan, azla
+ms.topic: how-to
+ms.date: 08/01/2022
+# Customer intent: As a developer, I want to prevent shared connections with other Azure Active Directory tenants.
+---
+
+# Block connections shared from other tenants in Azure Logic Apps (Preview)
+
+> [!NOTE]
+> This capability is in preview and is subject to the 
+> [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
+
+Azure Logic Apps includes many connectors for you to build integration apps and workflows and to access various data, apps, services, systems, and other resources. These connectors authorize your access to these resources by using Azure Active Directory (Azure AD) to authenticate your credentials.
+
+When you create a connection from your workflow to access a resource, you can share that connection with others in the same Azure AD tenant or different tenant by sending a consent link. This shared connection provides access to same resource but creates a security vulnerability.
+
+As a security measure to prevent this scenario, you can block access to and from your own Azure AD tenant through such shared connections. You can also permit but restrict connections only to specific tenants. By setting up a tenant isolation policy, you can better control data movement between your tenant and resources that require Azure AD authorized access.
+
+## Prerequisites
+
+- An Azure subscription and account with owner permissions to set up a new policy or make changes to existing tenant policies.
+
+  > [!NOTE]
+  >
+  > You can apply policies that affect only your own tenant, not other tenants.
+
+- Collect the following information:
+
+  - The tenant ID for your Azure AD tenant.
+
+  - The choice whether to enforce two-way tenant isolation for connections that don't have a client tenant ID.
+
+    For example, some legacy connections might not have an associated tenant ID. So, you have to choose whether to block or allow such connections.
+
+  - The choice whether to enable or disable the isolation policy.
+
+  - The tenant IDs for any tenants where you want to allow connections to or from your tenant.
+
+    If you choose to allow such connections, include the following information:
+    
+    - The choice whether to allow inbound connections to your tenant from each allowed tenant.
+
+    - The choice whether to allow inbound connections from your tenant to each allowed tenant.
+
+- To test the tenant isolation policy, you need a second Azure AD tenant. From this tenant, you'll try connecting to and from the isolated tenant after the isolation policy takes effect.
+
+## Request an isolation policy for your tenant
+
+To start this process, you'll request a new isolation policy or update your existing isolation policy for your tenant. Only Azure subscription owners can request new policies or changes to existing policies.
+
+1. Open a Customer Support ticket to request a new isolation policy or update your existing isolation policy for your tenant.
+
+1. Wait for the request to finish verification and processing by the person who handles the support ticket.
+
+   > [!NOTE]
+   >
+   > Policies take effect immediately in the West Central US region. However, these changes 
+   > might take up to four hours to replicate in all other regions.
+
+## Test the isolation policy
+
+After the policy takes effect in a region, test the policy. You can try immediately in the West Central US region.
+
+### Test inbound connections to your tenant
+
+1. Sign in to your "other" Azure AD tenant.
+
+1. Create logic app workflow with a connection, such as Office 365 Outlook.
+
+1. Try to sign in to your isolated tenant.
+
+   You get a message that the connection to the isolated tenant has failed authorization due to a tenant isolation configuration.
+
+### Test outbound connections from your tenant
+
+1. Sign in to your isolated tenant.
+
+1. Create a logic app workflow with a connection, such as Office 365 Outlook.
+
+1. Try to sign in to your other tenant.
+
+   You get a message that the connection to your other tenant has failed authorization due to a tenant isolation configuration.
+
+## Next steps
+
+[Block connector usage in Azure Logic Apps](block-connections-connectors.md)

articles/logic-apps/block-connections-connectors.md

@@ -1,14 +1,14 @@
 ---
-title: Block connections for specific API connectors
-description: Restrict creating and using API connections in Azure Logic Apps.
+title: Block connector usage
+description: Block creating and using specific API connections in Azure Logic Apps.
 services: logic-apps
 ms.suite: integration
 ms.reviewer: deli, estfan, azla
 ms.topic: how-to
 ms.date: 05/18/2022
 ---
 
-# Block connections created by connectors in Azure Logic Apps
+# Block connector usage in Azure Logic Apps
 
 If your organization doesn't permit connecting to restricted or unapproved resources using their [managed connectors](../connectors/managed.md) in Azure Logic Apps, you can block the capability to create and use those connections in logic app workflows. With [Azure Policy](../governance/policy/overview.md), you can define and enforce [policies](../governance/policy/overview.md#policy-definition) that prevent creating or using connections for connectors that you want to block. For example, for security reasons, you might want to block connections to specific social media platforms or other services and systems.
 

articles/logic-apps/toc.yml

@@ -368,8 +368,10 @@
       href: logic-apps-securing-a-logic-app.md
     - name: Authenticate with managed identities
       href: create-managed-service-identity.md
-    - name: Block connections in logic apps
+    - name: Block connector usage
       href: block-connections-connectors.md
+    - name: Block connections across tenants
+      href: block-connections-across-tenants.md
   - name: Manage
     items:
     - name: Manage logic apps - Azure portal