You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In an ideal world, all users follow the access policies to secure access to your organization's resources. However, sometimes there are business cases that require you to make exceptions. This article goes over some examples of situations where exclusions may be necessary. You, as the IT administrator, can manage this task, avoid oversight of policy exceptions, and provide auditors with proof that these exceptions are reviewed regularly using Azure Active Directory (Azure AD) access reviews.
24
24
25
-
>[!NOTE]
25
+
>[!NOTE]
26
26
> A valid Azure AD Premium P2, Enterprise Mobility + Security E5 paid, or trial license is required to use Azure AD access reviews. For more information, see [Azure Active Directory editions](../fundamentals/active-directory-whatis.md).
27
27
28
28
## Why would you exclude users from policies?
29
29
30
-
Let's say that as the administrator you decide to use [Azure AD Conditional Access](../conditional-access/overview.md) to require, multi-factor authentication (MFA) and limit authentication requests to specific networks or devices. During deployment planning, you realize that not all users can meet these requirements. For example, you may have users who work from remote offices not part of your internal network. You may also have to accommodate users connecting using unsupported devices while waiting for those devices to be replaced. In short, the business needs these users to sign in and do their job so you exclude them from Conditional Access policies.
30
+
Let's say that as the administrator, you decide to use [Azure AD Conditional Access](../conditional-access/overview.md) to requiremulti-factor authentication (MFA) and limit authentication requests to specific networks or devices. During deployment planning, you realize that not all users can meet these requirements. For example, you may have users who work from remote offices, not part of your internal network. You may also have to accommodate users connecting using unsupported devices while waiting for those devices to be replaced. In short, the business needs these users to sign in and do their job so you exclude them from Conditional Access policies.
31
31
32
32
As another example, you may be using [named locations](../conditional-access/location-condition.md) in Conditional Access to specify a set of countries and regions from which you don't want to allow users to access their tenant.
33
33
34
34
35
35
36
-
Unfortunately, some users may still have a valid reason to sign in from these blocked countries/regions. For example, users could be traveling for work and need to access corporate resources. In this case, the Conditional Access policy to block these countries/regions could use a cloud security group for the excluded users from the policy. Users who need access while traveling, can add themselves to the group using [Azure AD self-service Group management](../users-groups-roles/groups-self-service-management.md).
36
+
Unfortunately, some users may still have a valid reason to sign in from these blocked countries/regions. For example, users could be traveling for work and need to access corporate resources. In this case, the Conditional Access policy to block these countries/regions could use a cloud security group for the excluded users from the policy. Users who need access while traveling, can add themselves to the group using [Azure AD self-service Group management](../users-groups-roles/groups-self-service-management.md).
37
37
38
-
Another example might be that you have a Conditional Access policy [blocking legacy authentication for the vast majority of your users](https://cloudblogs.microsoft.com/enterprisemobility/2018/06/07/azure-ad-conditional-access-support-for-blocking-legacy-auth-is-in-public-preview/). However, if you have some users that absolutely need to use legacy authentication methods to access your resources via Office 2010 or IMAP/SMTP/POP based clients, then you can exclude these users from the policy that block legacy authentication methods.
38
+
Another example might be that you have a Conditional Access policy [blocking legacy authentication for the vast majority of your users](https://cloudblogs.microsoft.com/enterprisemobility/2018/06/07/azure-ad-conditional-access-support-for-blocking-legacy-auth-is-in-public-preview/). However, if you have some users that need to use legacy authentication methods to access your resources via Office 2010 or IMAP/SMTP/POP based clients, then you can exclude these users from the policy that blocks legacy authentication methods.
39
39
40
-
>[!NOTE]
41
-
>Microsoft strongly recommends that you block the use of legacy protocols in your tenant to improve your security posture.
40
+
>[!NOTE] Microsoft strongly recommends that you block the use of legacy protocols in your tenant to improve your security posture.
42
41
43
42
## Why are exclusions challenging?
44
43
45
-
In Azure AD, you can scope a Conditional Access policy to a set of users. You can also configure exclusions by selecting Azure AD roles, individual users, or guests users. It is important to remember that when exclusions are configured, the policy intent can't be enforced on excluded users. If exclusions are configured using list of users or using legacy on-premises security groups, they limit the visibility into the exclusions. As a result:
44
+
In Azure AD, you can scope a Conditional Access policy to a set of users. You can also configure exclusions by selecting Azure AD roles, individual users, or guests. You should keep in mind that when exclusions are configured, the policy intent can't be enforced on excluded users. If exclusions are configured using a list of users or using legacy on-premises security groups, you will have limited visibility into the exclusions. As a result:
46
45
47
-
- Users may not know that they are being excluded
48
-
- Users can join the security group to by-pass the policy so the IT administrator's control over the exceptions would be affected.
49
-
- Also, users who qualified for the exclusion at one time may no longer qualify for it.
46
+
- Users may not know that they are excluded.
50
47
51
-
Frequently at the beginning of an exclusion, there is a short list of users who bypass the policy. Over time, more and more users are excluded, and the list grows. At some point, you need to review the list and confirm that each of these users should still be excluded. Managing the list from a technical point of view, can be relatively easy, but who makes the business decisions and how do you make sure it is all auditable?
48
+
- Users can join the security group to bypass the policy.
52
49
53
-
However, if you configure the exclusion to the Conditional Access policy using an Azure AD group, you can then use access reviews as a compensating control, to drive visibility, and reduce the number of users who have are exempt.
50
+
- Excluded users may have qualified for the exclusion before but may no longer qualify for it.
51
+
52
+
Frequently, when you first configure an exclusion, there is a shortlist of users who bypass the policy. Over time, more and more users get added to the exclusion, and the list grows. At some point, you need to review the list and confirm that each of these users is still eligible for exclusion. Managing the exclusion list, from a technical point of view, can be relatively easy, but who makes the business decisions, and how do you make sure it is all auditable? However, if you configure the exclusion using an Azure AD group, you can use access reviews as a compensating control, to drive visibility, and reduce the number of excluded users.
54
53
55
54
## How to create an exclusion group in a Conditional Access policy
56
55
@@ -60,59 +59,60 @@ Follow these steps to create a new Azure AD group and a Conditional Access polic
60
59
61
60
1. Sign in to the Azure portal.
62
61
63
-
1. In the left navigation, click **Azure Active Directory** and then click **Groups**.
62
+
2. In the left navigation, click **Azure Active Directory** and then click **Groups**.
64
63
65
-
1. On the top menu, click **New Group** to open the group pane.
64
+
3. On the top menu, click **New Group** to open the group pane.
66
65
67
-
1. In the **Group type** list, select **Security**. Specify a name and description.
66
+
4. In the **Group type** list, select **Security**. Specify a name and description.
68
67
69
-
1. Make sure to set the **Membership** type to **Assigned**.
68
+
5. Make sure to set the **Membership** type to **Assigned**.
70
69
71
-
1. Select the users that should be part of this exclusion group and then click **Create**.
70
+
6. Select the users that should be part of this exclusion group and then click **Create**.
72
71
73
-
72
+
74
73
75
74
### Create a Conditional Access policy that excludes the group
76
75
77
76
Now you can create a Conditional Access policy that uses this exclusion group.
78
77
79
78
1. In the left navigation, click **Azure Active Directory** and then click **Conditional Access** to open the **Policies** blade.
80
79
81
-
1. Click **New policy** to open the **New** pane.
80
+
2. Click **New policy** to open the **New** pane.
82
81
83
-
1. Specify a name.
82
+
3. Specify a name.
84
83
85
-
1. Under Assignments click **Users and groups**.
84
+
4. Under Assignments click **Users and groups**.
86
85
87
-
1. On the **Include** tab, select **All Users**.
86
+
5. On the **Include** tab, select **All Users**.
88
87
89
-
1. On the **Exclude** tab, add a checkmark to **Users and groups** and then click **Select excluded users**.
88
+
6. On the **Exclude** tab, add a checkmark to **Users and groups** and then
89
+
click **Select excluded users**.
90
90
91
-
1. Select the exclusion group you created.
91
+
7. Select the exclusion group you created.
92
92
93
-
> [!NOTE]
94
-
> As a best practice, it is recommended to exclude at least one administrator account from the policy when testing to make sure you are not locked out of your tenant.
93
+
>[!NOTE] As a best practice, it is recommended to exclude at least one administrator account from the policy when testing to make sure you are not locked out of your tenant.
95
94
96
95
1. Continue with setting up the Conditional Access policy based on your organizational requirements.
97
96
98
-
99
-
97
+
98
+
100
99
Let's cover two examples where you can use access reviews to manage exclusions in Conditional Access policies.
101
100
102
101
## Example 1: Access review for users accessing from blocked countries/regions
103
102
104
-
Let's say you have a Conditional Access policy that blocks access from certain countries/regions. It includes a group that is excluded from the policy. Here is a recommended access review where members of the group are reviewed.
103
+
Let's say you have a Conditional Access policy that blocks access from certain countries/regions. It includes a group that is excluded from the policy. Here is
104
+
a recommended access review where members of the group are reviewed.
105
105
106
-
> [!NOTE]
107
-
> A Global administrator or User administrator role is required to create access reviews.
106
+
>[!NOTE] A Global administrator or User administrator role is required to create access reviews.
108
107
109
108
1. The review will happen every week.
110
109
111
110
2. Will never end in order to make sure you're keeping this exclusion group the most up to date.
112
111
113
112
3. All members of this group will be in scope for the review.
114
113
115
-
4. Each user will need to self-attest that they still need access from these blocked countries/regions, therefore they still need to be a member of the group.
114
+
4. Each user will need to self-attest that they still need access from these blocked countries/regions, therefore they still need to be a member of the
115
+
group.
116
116
117
117
5. If the user doesn't respond to the review request, they will be automatically removed from the group, and they will no longer have access the tenant while traveling to these countries/regions.
118
118
@@ -122,7 +122,8 @@ Let's say you have a Conditional Access policy that blocks access from certain c
122
122
123
123
## Example 2: Access review for users accessing with legacy authentication
124
124
125
-
Let's say you have a Conditional Access policy that blocks access for users using legacy authentication and older client versions and it includes a group that is excluded from the policy. Here is a recommended access review where members of the group are reviewed.
125
+
Let's say you have a Conditional Access policy that blocks access for users using legacy authentication and older client versions and it includes a group
126
+
that is excluded from the policy. Here is a recommended access review where members of the group are reviewed.
126
127
127
128
1. This review would need to be a recurring review.
128
129
@@ -138,22 +139,21 @@ Let's say you have a Conditional Access policy that blocks access for users usin
138
139
139
140
140
141
141
-
>[!IMPORTANT]
142
-
>If you have many exclusion groups and therefore need to create multiple access reviews, we now have an API in the Microsoft Graph beta endpoint that allows you to create and manage them programmatically. To get started, see the [Azure AD access reviews API reference](https://developer.microsoft.com/graph/docs/api-reference/beta/resources/accessreviews_root) and [Example of retrieving Azure AD access reviews via Microsoft Graph](https://techcommunity.microsoft.com/t5/Azure-Active-Directory/Example-of-retrieving-Azure-AD-access-reviews-via-Microsoft/td-p/236096).
142
+
>[!IMPORTANT] If you have many exclusion groups and therefore need to create multiple access reviews, we now have an API in the Microsoft Graph beta endpoint that allows you to create and manage them programmatically. To get started, see the [Azure AD access reviews API reference](https://developer.microsoft.com/graph/docs/api-reference/beta/resources/accessreviews_root) and [Example of retrieving Azure AD access reviews via Microsoft Graph](https://techcommunity.microsoft.com/t5/Azure-Active-Directory/Example-of-retrieving-Azure-AD-access-reviews-via-Microsoft/td-p/236096).
143
143
144
144
## Access review results and audit logs
145
145
146
146
Now that you have everything in place, group, Conditional Access policy, and access reviews, it is time to monitor and track the results of these reviews.
147
147
148
-
1. In the Azure portal, open the **Access reviews** blade.
148
+
1. In the Azure portal, open the **Access reviews** blade.
149
149
150
-
1. Open the control and program you have created for managing the exclusion group.
150
+
2. Open the control and program you have created for managing the exclusion group.
151
151
152
-
1. Click **Results** to see who was approved to stay on the list and who was removed.
152
+
3. Click **Results** to see who was approved to stay on the list and who was removed.
153
153
154
154
155
155
156
-
1. Then click **Audit logs** to see the actions that were taken during this review.
156
+
4. Then click **Audit logs** to see the actions that were taken during this review.
0 commit comments