You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: What is conditional access in Azure Active Directory? | Microsoft Docs
3
-
description: Learn how conditional access in Azure Active Directory helps you to implement automated access decisions that are not only based on who tries to access a resource but also how a resource is accessed.
2
+
title: What is Conditional Access in Azure Active Directory? | Microsoft Docs
3
+
description: Learn how Conditional Access in Azure Active Directory helps you to implement automated access decisions that are not only based on who tries to access a resource but also how a resource is accessed.
4
4
5
5
services: active-directory
6
6
ms.service: active-directory
@@ -13,18 +13,18 @@ author: MicrosoftGuyJFlo
13
13
manager: daveba
14
14
ms.reviewer: calebb
15
15
16
-
#Customer intent: As an IT admin, I want to understand conditional access well enough so that I can control how users are accessing my resources.
16
+
#Customer intent: As an IT admin, I want to understand Conditional Access well enough so that I can control how users are accessing my resources.
17
17
ms.collection: M365-identity-device-management
18
18
---
19
-
# What is conditional access in Azure Active Directory?
19
+
# What is Conditional Access?
20
20
21
-
Security is a top concern for organizations using the cloud. A key aspect of cloud security is identity and access when it comes to managing your cloud resources. In a mobile-first, cloud-first world, users can access your organization's resources using a variety of devices and apps from anywhere. As a result of this, just focusing on who can access a resource is not sufficient anymore. To master the balance between security and productivity, you also need to factor how a resource is accessed into an access control decision. With Azure Active Directory (Azure AD) conditional access, you can address this requirement. Conditional access is a capability of Azure Active Directory. With conditional access, you can implement automated access control decisions for accessing your cloud apps that are based on conditions.
21
+
Security is a top concern for organizations using the cloud. A key aspect of cloud security is identity and access when it comes to managing your cloud resources. In a mobile-first, cloud-first world, users can access your organization's resources using a variety of devices and apps from anywhere. As a result of this, just focusing on who can access a resource is not sufficient anymore. To master the balance between security and productivity, you also need to factor how a resource is accessed into an access control decision. With Azure Active Directory (Azure AD) Conditional Access, you can address this requirement. Conditional Access is a capability of Azure Active Directory. With Conditional Access, you can implement automated access control decisions for accessing your cloud apps that are based on conditions.
22
22
23
-
Conditional access policies are enforced after the first-factor authentication has been completed. Therefore, conditional access is not intended as a first line defense for scenarios like denial-of-service (DoS) attacks, but can utilize signals from these events (e.g. the sign-in risk level, location of the request, and so on) to determine access.
23
+
Conditional Access policies are enforced after the first-factor authentication has been completed. Therefore, Conditional Access is not intended as a first line defense for scenarios like denial-of-service (DoS) attacks, but can utilize signals from these events (e.g. the sign-in risk level, location of the request, and so on) to determine access.
24
24
25
25

26
26
27
-
This article provides you with a conceptual overview of conditional access in Azure AD.
27
+
This article provides you with a conceptual overview of Conditional Access in Azure AD.
28
28
29
29
## Common scenarios
30
30
@@ -33,9 +33,9 @@ In a mobile-first, cloud-first world, Azure Active Directory enables single sign
33
33
- Empower users to be productive wherever and whenever
34
34
- Protect the corporate assets at any time
35
35
36
-
By using conditional access policies, you can apply the right access controls under the required conditions. Azure AD conditional access provides you with added security when needed and stays out of your user’s way when it isn’t.
36
+
By using Conditional Access policies, you can apply the right access controls under the required conditions. Azure AD Conditional Access provides you with added security when needed and stays out of your user’s way when it isn’t.
37
37
38
-
Following are some common access concerns that conditional access can help you with:
38
+
Following are some common access concerns that Conditional Access can help you with:
39
39
40
40
-**[Sign-in risk](conditions.md#sign-in-risk)**: Azure AD Identity Protection detects sign-in risks. How do you restrict access if a detected sign-in risk indicates a bad actor? What if you would like to get stronger evidence that a sign-in was performed by the legitimate user? What if your doubts are strong enough to even block specific users from accessing an app?
41
41
@@ -45,40 +45,39 @@ Following are some common access concerns that conditional access can help you w
45
45
46
46
-**[Client application](conditions.md#client-apps)**: Today, you can access many cloud apps using different app types such as web-based apps, mobile apps, or desktop apps. What if an access attempt is performed using a client app type that causes known issues? What if you require a device that is managed by your IT department for certain app types?
47
47
48
-
These questions and the related answers represent common access scenarios for Azure AD conditional access.
49
-
Conditional access is a capability of Azure Active Directory that enables you to handle access scenarios using a policy-based approach.
48
+
These questions and the related answers represent common access scenarios for Azure AD Conditional Access.
49
+
Conditional Access is a capability of Azure Active Directory that enables you to handle access scenarios using a policy-based approach.
A conditional access policy is a definition of an access scenario using the following pattern:
55
+
A Conditional Access policy is a definition of an access scenario using the following pattern:
56
56
57
57

58
58
59
-
**Then do this** specifies the response of your policy. It is important to note that the objective of a conditional access policy is not to grant access to a cloud app. In Azure AD, granting access to cloud apps is subject of user assignments. With a conditional access policy, you control how authorized users (users that have been granted access to a cloud app) can access cloud apps under specific conditions. In your response, you enforce additional requirements such as multi-factor authentication, a managed device, and others. In the context of Azure AD conditional access, the requirements your policy enforces are called access controls. In the most restrictive form, your policy can block access. For more information, see [Access controls in Azure Active Directory conditional access](controls.md).
60
59
61
-
**When this happens** defines the reason for triggering your policy. This reason is characterized by a group of conditions that have been satisfied. In Azure AD conditional access, the two assignment conditions play a special role:
60
+
**When this happens** defines the reason for triggering your policy. This reason is characterized by a group of conditions that have been satisfied. In Azure AD Conditional Access, the two assignment conditions play a special role:
62
61
63
62
-**[Users](conditions.md#users-and-groups)**: The users performing an access attempt (**Who**).
64
63
65
64
-**[Cloud apps](conditions.md#cloud-apps-and-actions)**: The targets of an access attempt (**What**).
66
65
67
-
These two conditions are mandatory in a conditional access policy. In addition to the two mandatory conditions, you can also include additional conditions that describe how the access attempt is performed. Common examples are using mobile devices or locations that are outside your corporate network. For more information, see [Conditions in Azure Active Directory conditional access](conditions.md).
66
+
These two conditions are mandatory in a Conditional Access policy. In addition to the two mandatory conditions, you can also include additional conditions that describe how the access attempt is performed. Common examples are using mobile devices or locations that are outside your corporate network. For more information, see [Conditions in Azure Active Directory Conditional Access](conditions.md).
68
67
69
-
The combination of conditions with your access controls represents a conditional access policy.
68
+
The combination of conditions with your access controls represents a Conditional Access policy.
70
69
71
70

72
71
73
-
With Azure AD conditional access, you can control how authorized users can access your cloud apps. The objective of a conditional access policy is to enforce additional access controls on an access attempt to a cloud app based on how an access attempt is performed.
72
+
With Azure AD Conditional Access, you can control how authorized users can access your cloud apps. The objective of a Conditional Access policy is to enforce additional access controls on an access attempt to a cloud app based on how an access attempt is performed.
74
73
75
74
A policy-based approach to protect access to your cloud apps enables you to start drafting the policy requirements for your environment using the structure outlined in this article without worrying about the technical implementation.
76
75
77
-
## Azure AD conditional access and federated authentication
76
+
## Azure AD Conditional Access and federated authentication
78
77
79
-
Conditional access policies work seamlessly with [federated authentication](../../security/azure-ad-choose-authn.md#federated-authentication). This support includes all supported conditions and controls and visibility into how policy is applied to active user sign-ins using [Azure AD reporting](../reports-monitoring/concept-sign-ins.md).
78
+
Conditional Access policies work seamlessly with [federated authentication](../../security/azure-ad-choose-authn.md#federated-authentication). This support includes all supported conditions and controls and visibility into how policy is applied to active user sign-ins using [Azure AD reporting](../reports-monitoring/concept-sign-ins.md).
80
79
81
-
*Federated authentication with Azure AD* means that a trusted authentication service handles user authentication to Azure AD. A trusted authentication service is, for example, Active Directory Federation Services (AD FS), or any other federation service. In this configuration, primary user authentication is performed at the service and then Azure AD is used to sign into individual applications. Azure AD conditional access is applied before access is granted to the application the user is accessing.
80
+
*Federated authentication with Azure AD* means that a trusted authentication service handles user authentication to Azure AD. A trusted authentication service is, for example, Active Directory Federation Services (AD FS), or any other federation service. In this configuration, primary user authentication is performed at the service and then Azure AD is used to sign into individual applications. Azure AD Conditional Access is applied before access is granted to the application the user is accessing.
82
81
83
82
When the configured conditional access policy requires multi-factor authentication, Azure AD defaults to using Azure MFA. If you use the federation service for MFA, you can configure Azure AD to redirect to the federation service when MFA is needed by setting `-SupportsMFA` to `$true` in [PowerShell](https://docs.microsoft.com/powershell/module/msonline/set-msoldomainfederationsettings). This setting works for federated authentication services that support the MFA challenge request issued by Azure AD using `wauth= http://schemas.microsoft.com/claims/multipleauthn`.
84
83
@@ -90,4 +89,4 @@ After the user has signed in to the federated authentication service, Azure AD h
90
89
91
90
## Next steps
92
91
93
-
To learn how to implement conditional access in your environment, see [Plan your conditional access deployment in Azure Active Directory](plan-conditional-access.md).
92
+
To learn how to implement Conditional Access in your environment, see [Plan your Conditional Access deployment in Azure Active Directory](plan-conditional-access.md).
Copy file name to clipboardExpand all lines: articles/active-directory/devices/concept-azure-managed-workstation.md
+3Lines changed: 3 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -23,6 +23,9 @@ Secured isolated workstations are critically important for the security of sensi
23
23
24
24
This document explains what it takes to build a secure client workstation with detailed step by step instructions, including how to set up starting security controls. This type of workstations at times is called a privileged access workstation (PAW), which this reference is used, and built upon. The guidance however looks to cloud-based technology to manage the service, and introduces security capabilities introduced starting in Windows 10RS5, Microsoft Defender ATP, Azure Active Directory, and Intune.
25
25
26
+
> [!NOTE]
27
+
> This article explains the concept of secure workstation and its importance. If you are already familiar with the concept and would like to skip to deployment, please read [How to Deploy a Secure Workstation](https://docs.microsoft.com/en-us/azure/active-directory/devices/howto-azure-managed-workstation).
28
+
26
29
## Why securing workstation access is important
27
30
28
31
The rapid adoption of cloud services and the ability to work from anywhere has created a new method for exploitation. Attackers are exploiting weak security controls on devices where administrators work and are able to gain access to privileged resources.
Copy file name to clipboardExpand all lines: articles/app-service/operating-system-functionality.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -61,7 +61,7 @@ It is important to monitor your disk utilization as your application grows. If t
61
61
62
62
- The app may throw an error indicating not enough space on the disk.
63
63
- You may see disk errors when browsing to the Kudu console.
64
-
- Deployment from VSTS or Visual Studio may fail with `ERROR_NOT_ENOUGH_DISK_SPACE: Web deployment task failed. (Web Deploy detected insufficient space on disk)`.
64
+
- Deployment from Azure DevOps or Visual Studio may fail with `ERROR_NOT_ENOUGH_DISK_SPACE: Web deployment task failed. (Web Deploy detected insufficient space on disk)`.
Copy file name to clipboardExpand all lines: articles/azure-cache-for-redis/cache-faq.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -247,7 +247,7 @@ You can use any of the commands listed at [Redis commands](https://redis.io/comm
247
247
*`redis-cli -h <Azure Cache for Redis name>.redis.cache.windows.net -a <key>`
248
248
249
249
> [!NOTE]
250
-
> The Redis command-line tools do not work with the SSL port, but you can use a utility such as `stunnel` to securely connect the tools to the SSL port by following the directions in the [Announcing ASP.NET Session State Provider for Redis Preview Release](https://blogs.msdn.com/b/webdev/archive/2014/05/12/announcing-asp-net-session-state-provider-for-redis-preview-release.aspx) blog post.
250
+
> The Redis command-line tools do not work with the SSL port, but you can use a utility such as `stunnel` to securely connect the tools to the SSL port by following the directions in the [How to use the Redis command-line tool with Azure Cache for Redis](https://docs.microsoft.com/en-us/azure/azure-cache-for-redis/cache-how-to-redis-cli-tool) article.
Copy file name to clipboardExpand all lines: articles/azure-maps/how-to-request-real-time-data.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -110,9 +110,9 @@ Let's use "522" as our metro ID, which is the metro ID for "Seattle–Tacoma–B
110
110
}
111
111
112
112
113
-
## Real-time availability and vacancy information for bike docking station
113
+
## Real-time data for bike docking station
114
114
115
-
The [Get Transit Dock Info API](https://aka.ms/AzureMapsMobilityTransitDock) of the Azure Maps Mobility Service, allows to request static and real-time information for a given bike or scooter docking station. We will make a request to get real-time data for a docking station for bikes.
115
+
The [Get Transit Dock Info API](https://aka.ms/AzureMapsMobilityTransitDock) of the Azure Maps Mobility Service, allows to request static and real-time information such as availability and vacancy information for a given bike or scooter docking station. We will make a request to get real-time data for a docking station for bikes.
116
116
117
117
In order to make a request to the Get Transit Dock Info API, you will need the **dockId** for that station. You can get the dock ID by making a search request to the [Get Nearby Transit API](https://aka.ms/AzureMapsMobilityNearbyTransit) and setting the **objectType** parameter to "bikeDock". Follow the steps below to get real-time data of a docking station for bikes.
Copy file name to clipboardExpand all lines: articles/azure-monitor/app/correlation.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ ms.service: application-insights
9
9
ms.workload: TBD
10
10
ms.tgt_pltfrm: ibiza
11
11
ms.topic: conceptual
12
-
ms.date: 02/14/2019
12
+
ms.date: 06/07/2019
13
13
ms.reviewer: sergkanz
14
14
ms.author: lagayhar
15
15
---
@@ -29,7 +29,7 @@ Every outgoing operation, such as an HTTP call to another component, is represen
29
29
30
30
You can build a view of the distributed logical operation by using `operation_Id`, `operation_parentId`, and `request.id` with `dependency.id`. These fields also define the causality order of telemetry calls.
31
31
32
-
In a microservices environment, traces from components can go to different storage items. Every component can have its own instrumentation key in Application Insights. To get telemetry for the logical operation, you must query data from every storage item. When the number of storage items is huge, you'll need a hint about where to look next. The Application Insights data model defines two fields to solve this problem: `request.source` and `dependency.target`. The first field identifies the component that initiated the dependency request, and the second identifies which component returned the response of the dependency call.
32
+
In a microservices environment, traces from components can go to different storage items. Every component can have its own instrumentation key in Application Insights. To get telemetry for the logical operation, the Application Insights UX queries data from every storage item. When the number of storage items is huge, you'll need a hint about where to look next. The Application Insights data model defines two fields to solve this problem: `request.source` and `dependency.target`. The first field identifies the component that initiated the dependency request, and the second identifies which component returned the response of the dependency call.
0 commit comments