You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Require an app protection policy on Windows devices (preview)
19
19
20
-
App protection policies apply mobile application management (MAM) to specific applications on a device. These policies allow for securing data within an application in support of scenarios like bring your own device (BYOD). In the preview, we support applying policy to the Microsoft Edge browser on Windows 11 devices.
20
+
App protection policies apply [mobile application management (MAM)](/mem/intune/apps/app-management#mobile-application-management-mam-basics) to specific applications on a device. These policies allow for securing data within an application in support of scenarios like bring your own device (BYOD). In the preview, we support applying policy to the Microsoft Edge browser on Windows 11 devices.
21
21
22
22
23
23
24
24
## Prerequisites
25
25
26
-
Customers interested in the public preview need to opt in using the [MAM for Windows Public Preview Sign Up Form](https://aka.ms/MAMforWindowsPublic).
26
+
-[Windows 11 Version 22H2 (OS build 22621)](/windows/release-health/windows11-release-information#windows-11-current-versions) or newer.
27
+
-[Configured app protection policy targeting Windows devices](/mem/intune/apps/app-protection-policy-settings-windows).
@@ -34,7 +36,13 @@ The following policy is put in to [Report-only mode](howto-conditional-access-in
34
36
35
37
### Require app protection policy for Windows devices
36
38
37
-
The following steps help create a Conditional Access policy requiring an app protection policy when using a Windows device. The app protection policy must also be configured and assigned to your users in Microsoft Intune. For more information about how to create the app protection policy, see the article [Preview: App protection policy settings for Windows](/mem/intune/apps/app-protection-policy-settings-windows). The following policy includes multiple controls allowing devices to either use app protection policies for mobile application management (MAM) or be managed and compliant with mobile device management (MDM) policies.
39
+
The following steps help create a Conditional Access policy requiring an app protection policy when using a Windows device. The app protection policy must also be configured and assigned to your users in Microsoft Intune. For more information about how to create the app protection policy, see the article [App protection policy settings for Windows](/mem/intune/apps/app-protection-policy-settings-windows). The following policy includes multiple controls allowing devices to either use app protection policies for mobile application management (MAM) or be managed and compliant with mobile device management (MDM) policies.
40
+
41
+
> [!TIP]
42
+
> App protection policies (MAM) support unmanaged devices:
43
+
>
44
+
> - If a device is already managed through mobile device management (MDM), then Intune MAM enrollment is blocked, and app protection policy settings aren't applied.
45
+
> - If a device becomes managed after MAM enrollment, app protection policy settings are no longer applied.
38
46
39
47
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Conditional Access Administrator](../roles/permissions-reference.md#conditional-access-administrator).
40
48
1. Browse to **Protection** > **Conditional Access**.
@@ -44,12 +52,14 @@ The following steps help create a Conditional Access policy requiring an app pro
44
52
1. Under **Include**, select **All users**.
45
53
1. Under **Exclude**, select **Users and groups** and choose at least your organization's emergency access or break-glass accounts.
> Selecting **All apps** prevents users from signing in.
47
57
1. Under **Conditions**:
48
-
1.**Device platforms**, set **Configure** to **Yes**.
58
+
1.**Device platforms** set **Configure** to **Yes**.
49
59
1. Under **Include**, **Select device platforms**.
50
60
1. Choose **Windows** only.
51
61
1. Select **Done**.
52
-
1.**Client apps**, set **Configure** to **Yes**.
62
+
1.**Client apps** set **Configure** to **Yes**.
53
63
1. Select **Browser** only.
54
64
1. Under **Access controls** > **Grant**, select **Grant access**.
55
65
1. Select **Require app protection policy** and **Require device to be marked as compliant**.
@@ -62,6 +72,17 @@ After administrators confirm the settings using [report-only mode](howto-conditi
62
72
> [!TIP]
63
73
> Organizations should also deploy a policy that [blocks access from unsupported or unknown device platforms](howto-policy-unknown-unsupported-device.md) along with this policy.
64
74
75
+
In organizations with existing Conditional Access policies that target:
76
+
77
+
- The **All cloud apps** resource.
78
+
- The **Mobile apps and desktop clients** condition.
79
+
- Use **Require app protection policy** or a **Block access** grant control.
80
+
81
+
End users are unable to enroll their Windows device in MAM without the following policy changes.
82
+
83
+
1. Register the **Microsoft Edge Auth** service principal in your tenant using the command `New-MgServicePrincipal -AppId f2d19332-a09d-48c8-a53b-c49ae5502dfc`.
84
+
1. Add an exclusion for **Microsoft Edge Auth** to your existing policy targeting **All cloud apps**.
85
+
65
86
## Sign in to Windows devices
66
87
67
88
When users attempt to sign in to a site that is protected by an app protection policy for the first time, they're prompted: To access your service, app or website, you may need to sign in to Microsoft Edge using `[email protected]` or register your device with `organization` if you're already signed in.
@@ -79,7 +100,7 @@ This process opens a window offering to allow Windows to remember your account a
79
100
80
101
81
102
82
-
After selecting **OK**, you may see a progress window while policy is applied. After a few moments, you should see a window saying "you're all set", app protection policies are applied.
103
+
After selecting **OK**, you may see a progress window while policy is applied. After a few moments, you should see a window saying **You're all set**, app protection policies are applied.
83
104
84
105
## Troubleshooting
85
106
@@ -96,9 +117,13 @@ To resolve these possible scenarios:
96
117
- Wait a few minutes and try again in a new tab.
97
118
- Contact your administrator to check that Microsoft Intune MAM policies are applying to your account correctly.
98
119
120
+
#### All apps selected
121
+
122
+
If your policy for Windows devices targets **All apps** your users aren't able to sign in. Your policy should only target **Office 365**.
123
+
99
124
### Existing account
100
125
101
-
If there's a pre-existing, unregistered account, like `[email protected]` in Microsoft Edge, or if a user signs in without registering using the Heads Up Page, then the account isn't properly enrolled in MAM. This configuration blocks the user from being properly enrolled in MAM. This is a known issue.
126
+
There's a known issue where there's a pre-existing, unregistered account, like `[email protected]` in Microsoft Edge, or if a user signs in without registering using the Heads Up Page, then the account isn't properly enrolled in MAM. This configuration blocks the user from being properly enrolled in MAM.
Copy file name to clipboardExpand all lines: articles/active-directory/conditional-access/howto-policy-approved-app-or-app-protection.md
+3Lines changed: 3 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -63,6 +63,9 @@ Organizations can choose to deploy this policy using the steps outlined below or
63
63
64
64
After administrators confirm the settings using [report-only mode](howto-conditional-access-insights-reporting.md), they can move the **Enable policy** toggle from **Report-only** to **On**.
65
65
66
+
> [!TIP]
67
+
> Organizations should also deploy a policy that [blocks access from unsupported or unknown device platforms](howto-policy-unknown-unsupported-device.md) along with this policy.
68
+
66
69
### Block Exchange ActiveSync on all devices
67
70
68
71
This policy will block all Exchange ActiveSync clients using basic authentication from connecting to Exchange Online.
#Customer intent: As a React developer, I want to know how to use functional components to add sign in and sign out experiences in my React application.
Copy file name to clipboardExpand all lines: articles/active-directory/hybrid/connect/how-to-connect-syncservice-features.md
+13-13Lines changed: 13 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -27,16 +27,16 @@ The synchronization feature of Microsoft Entra Connect has two components:
27
27
28
28
This topic explains how the following features of the **Microsoft Entra Connect Sync service** work and how you can configure them using PowerShell.
29
29
30
-
These settings are configured by the [Azure AD PowerShell module](/previous-versions/azure/jj151815(v=azure.100)). Download and install it separately from Microsoft Entra Connect. The cmdlets documented in this topic were introduced in the [2016 March release (build 9031.1)](https://social.technet.microsoft.com/wiki/contents/articles/28552.microsoft-azure-active-directory-powershell-module-version-release-history.aspx#Version_9031_1). If you do not have the cmdlets documented in this topic or they do not produce the same result, then make sure you run the latest version.
30
+
These settings are configured by the [Azure AD PowerShell module](/previous-versions/azure/jj151815(v=azure.100)). Download and install it separately from Microsoft Entra Connect. The cmdlets documented in this topic were introduced in the [2016 March release (build 9031.1)](https://social.technet.microsoft.com/wiki/contents/articles/28552.microsoft-azure-active-directory-powershell-module-version-release-history.aspx#Version_9031_1). If you don't have the cmdlets documented in this topic or they don't produce the same result, then make sure you run the latest version.
31
31
32
32
To see the configuration in your Microsoft Entra directory, run `Get-MsolDirSyncFeatures`.
Get-MgDirectoryOnPremisSynchronization | Select-Object -ExpandProperty Features | Format-List
39
+
Get-MgDirectoryOnPremiseSynchronization | Select-Object -ExpandProperty Features | Format-List
40
40
```
41
41
42
42
The output looks similar to `Get-MsolDirSyncFeatures`:
@@ -72,20 +72,20 @@ The following settings can be configured by `Set-MsolDirSyncFeature`:
72
72
|[EnableSoftMatchOnUpn](#userprincipalname-soft-match)|Allows objects to join on userPrincipalName in addition to primary SMTP address. |
73
73
|[SynchronizeUpnForManagedUsers](#synchronize-userprincipalname-updates)|Allows the sync engine to update the userPrincipalName attribute for managed/licensed (non-federated) users. |
74
74
75
-
After you have enabled a feature, it cannot be disabled again.
75
+
After you have enabled a feature, it can't be disabled again.
76
76
77
77
> [!NOTE]
78
78
> From August 24, 2016 the feature *Duplicate attribute resiliency* is enabled by default for new Microsoft Entra directories. This feature will also be rolled out and enabled on directories created before this date. You will receive an email notification when your directory is about to get this feature enabled.
79
79
>
80
80
>
81
81
82
-
The following settings are configured by Microsoft Entra Connect and cannot be modified by `Set-MsolDirSyncFeature`:
82
+
The following settings are configured by Microsoft Entra Connect and can't be modified by `Set-MsolDirSyncFeature`:
|[DuplicateProxyAddressResiliency<br/>DuplicateUPNResiliency](#duplicate-attribute-resiliency)|Allows an attribute to be quarantined when it is a duplicate of another object rather than failing the entire object during export. |
88
+
|[DuplicateProxyAddressResiliency<br/>DuplicateUPNResiliency](#duplicate-attribute-resiliency)|Allows an attribute to be quarantined when its a duplicate of another object rather than failing the entire object during export. |
89
89
| Password Hash Sync |[Implementing password hash synchronization with Microsoft Entra Connect Sync](how-to-connect-password-hash-synchronization.md)|
90
90
|Pass-through Authentication|[User sign-in with Microsoft Entra pass-through authentication](how-to-connect-pta.md)|
91
91
| UnifiedGroupWriteback |Group writeback|
@@ -99,27 +99,27 @@ Instead of failing to provision objects with duplicate UPNs / proxyAddresses, th
99
99
100
100
When this feature is enabled, soft-match is enabled for UPN in addition to the [primary SMTP address](https://support.microsoft.com/kb/2641663), which is always enabled. Soft-match is used to match existing cloud users in Microsoft Entra ID with on-premises users.
101
101
102
-
If you need to match on-premises AD accounts with existing accounts created in the cloud and you are not using Exchange Online, then this feature is useful. In this scenario, you generally don’t have a reason to set the SMTP attribute in the cloud.
102
+
If you need to match on-premises AD accounts with existing accounts created in the cloud and you aren't using Exchange Online, then this feature is useful. In this scenario, you generally don’t have a reason to set the SMTP attribute in the cloud.
103
103
104
104
This feature is on by default for newly created Microsoft Entra directories. You can see if this feature is enabled for you by running:
When this feature is enabled it will block the Soft Match feature. Customers are encouraged to enable this feature and keep it at enabled until Soft Matching is required again for their tenancy. This flag should be enabled again after any soft matching has completed and is no longer needed.
122
+
When this feature is enabled, it blocks the Soft Match feature. Customers are encouraged to enable this feature and keep it at enabled until Soft Matching is required again for their tenancy. This flag should be enabled again after any soft matching has completed and is no longer needed.
123
123
124
124
Example - to block soft matching in your tenant, run this cmdlet:
Historically, updates to the UserPrincipalName attribute using the sync service from on-premises has been blocked, unless both of these conditions were true:
133
133
134
134
* The user is managed (non-federated).
135
-
* The user has not been assigned a license.
135
+
* The user hasn't been assigned a license.
136
136
137
137
> [!NOTE]
138
138
> From March 2019, synchronizing UPN changes for federated user accounts is allowed.
@@ -146,12 +146,12 @@ This feature is on by default for newly created Microsoft Entra directories. You
@@ -58,10 +62,9 @@ The Microsoft Entra provisioning service allows you to scope who is provisioned
58
62
59
63
* If you need more roles, you can [update the application manifest](../develop/howto-add-app-roles-in-azure-ad-apps.md) to add new roles.
60
64
61
-
62
65
## Step 5: Configure automatic user provisioning to Hypervault
63
66
64
-
This section guides you through the steps to configure the Microsoft Entra provisioning service to create, update, and disable users in TestApp based on user assignments in Microsoft Entra ID.
67
+
This section guides you through the steps to configure the Microsoft Entra provisioning service to create, update, and disable users in Hypervault based on user assignments in Microsoft Entra ID.
@@ -84,7 +87,7 @@ This section guides you through the steps to configure the Microsoft Entra provi
84
87
85
88
86
89
87
-
1. Under the **Admin Credentials** section, input your Hypervault Tenant URL and Secret Token. Click **Test Connection** to ensure Microsoft Entra ID can connect to Hypervault. If the connection fails, ensure your Hypervault account has Admin permissions and try again.
90
+
1. Under the **Admin Credentials** section, input your Hypervault Tenant URL and Secret Token (generated in step 2). Click **Test Connection** to ensure Microsoft Entra ID can connect to Hypervault. If the connection fails, ensure your Hypervault account has Admin permissions and try again.
88
91
89
92
Copy file name to clipboardExpand all lines: articles/active-directory/workload-identities/workload-identities-faqs.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -82,7 +82,7 @@ suspicious changes to accounts.
82
82
Enables delegation of reviews to the right people, focused on the most
83
83
important privileged roles.
84
84
85
-
-[App health recommendations](/azure/active-directory/reports-monitoring/howto-use-recommendations): Provides you with personalized insights with actionable guidance so you can implement best practices, improve the state of your Microsoft Entra tenant, and optimize the configurations for your scenarios.
85
+
-[App health recommendations](/azure/active-directory/reports-monitoring/howto-use-recommendations): Provides recommendations for addressing identity hygiene gaps in your application portfolio so you can improve the security and resilience posture of a tenant.
86
86
87
87
## What do the numbers in each category on the [Workload identities - Microsoft Entra admin center](https://entra.microsoft.com/#view/Microsoft_Azure_ManagedServiceIdentity/WorkloadIdentitiesBlade) mean?
0 commit comments