Skip to content

Commit b273259

Browse files
v-dirichardsv-dirichards
authored
Merge pull request #251715 from MicrosoftGuyJFlo/StepFixes
[Microsoft Entra] Step 1 and 2 fixes for team
2 parents 3715f95 + 1f59c48 commit b273259

File tree

2 files changed

+32
-37
lines changed

2 files changed

+32
-37
lines changed

‎articles/active-directory/architecture/7-secure-access-conditional-access.md

Lines changed: 27 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -76,24 +76,22 @@ Use a naming convention that clarifies policy purpose. External access examples
7676

7777
You can block external users from accessing resources with Conditional Access policies.
7878

79-
1. Sign in to the [Azure portal](https://portal.azure.com) as a Conditional Access Administrator, Security Administrator, or Global Administrator.
80-
2. Browse to **Azure Active Directory** > **Security** > **Conditional Access**.
81-
3. Select **New policy**.
82-
4. Enter a policy a name.
83-
5. Under **Assignments**, select **Users or workload identities**.
84-
6. Under **Include**, select **All guests and external users**.
85-
7. Under **Exclude**, select **Users and groups**.
86-
8. Select emergency access accounts.
87-
9. Select **Done**.
88-
10. Under **Cloud apps or actions** > **Include**, select **All cloud apps**.
89-
11. Under **Exclude**, select applications you want to exclude.
90-
12. Under **Access controls** > **Grant**, select **Block access**.
91-
13. Select **Select**.
92-
14. Select **Enable policy** to **Report-only**.
93-
15. Select **Create**.
79+
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Conditional Access Administrator](../roles/permissions-reference.md#conditional-access-administrator).
80+
1. Browse to **Protection** > **Conditional Access**.
81+
1. Select **Create new policy**.
82+
1. Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies.
83+
1. Under **Assignments**, select **Users or workload identities**.
84+
1. Under **Include**, select **All guests and external users**.
85+
1. Under **Exclude**, select **Users and groups** and choose your organization's emergency access or break-glass accounts.
86+
1. Under **Target resources** > **Cloud apps**, select the following options:
87+
1. Under **Include**, select **All cloud apps**
88+
1. Under **Exclude**, select applications you want to exclude.
89+
1. Under **Access controls** > **Grant**, select **Block access**, then select **Select**.
90+
1. Confirm your settings and set **Enable policy** to **Report-only**.
91+
1. Select **Create** to create to enable your policy.
9492

9593
> [!NOTE]
96-
> You can confirm settings in **report only** mode. See, Configure a Conditional Access policy in repory-only mode, in [Conditional Access insights and reporting](../conditional-access/howto-conditional-access-insights-reporting.md).
94+
> After administrators confirm the settings using [report-only mode](../conditional-access/howto-conditional-access-insights-reporting.md), they can move the **Enable policy** toggle from **Report-only** to **On**.
9795
9896
Learn more: [Manage emergency access accounts in Azure AD](../roles/security-emergency-access.md)
9997

@@ -103,24 +101,21 @@ There are scenarios when it's necessary to allow access for a small, specific gr
103101

104102
Before you begin, we recommend you create a security group, which contains external users who access resources. See, [Quickstart: Create a group with members and view all groups and members in Azure AD](../fundamentals/groups-view-azure-portal.md).
105103

106-
1. Sign in to the [Azure portal](https://portal.azure.com) as a Conditional Access Administrator, Security Administrator, or Global Administrator.
107-
2. Browse to **Azure Active Directory** > **Security** > **Conditional Access**.
108-
3. Select **New policy**.
109-
4. Enter a policy name.
110-
5. Under **Assignments**, select **Users or workload identities**.
111-
6. Under **Include**, select **All guests and external users**.
112-
7. Under **Exclude**, select **Users and groups**
113-
8. Select emergency access accounts.
114-
9. Select the external users security group.
115-
10. Select **Done**.
116-
11. Under **Cloud apps or actions** > **Include**, select **All cloud apps**.
117-
12. Under **Exclude**, select applications you want to exclude.
118-
13. Under **Access controls** > **Grant**, select **Block access**.
119-
14. Select **Select**.
120-
15. Select **Create**.
104+
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Conditional Access Administrator](../roles/permissions-reference.md#conditional-access-administrator).
105+
1. Browse to **Protection** > **Conditional Access**.
106+
1. Select **Create new policy**.
107+
1. Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies.
108+
1. Under **Assignments**, select **Users or workload identities**.
109+
1. Under **Include**, select **All guests and external users**.
110+
1. Under **Exclude**, select **Users and groups** and choose your organization's emergency access or break-glass accounts and the external users security group.
111+
1. Under **Target resources** > **Cloud apps**, select the following options:
112+
1. Under **Include**, select **All cloud apps**
113+
1. Under **Exclude**, select applications you want to exclude.
114+
1. Under **Access controls** > **Grant**, select **Block access**, then select **Select**.
115+
1. Select **Create** to create to enable your policy.
121116

122117
> [!NOTE]
123-
> You can confirm settings in **report only** mode. See, Configure a Conditional Access policy in repory-only mode, in [Conditional Access insights and reporting](../conditional-access/howto-conditional-access-insights-reporting.md).
118+
> After administrators confirm the settings using [report-only mode](../conditional-access/howto-conditional-access-insights-reporting.md), they can move the **Enable policy** toggle from **Report-only** to **On**.
124119
125120
Learn more: [Manage emergency access accounts in Azure AD](../roles/security-emergency-access.md)
126121

‎articles/active-directory/privileged-identity-management/groups-activate-roles.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -60,9 +60,9 @@ If the [role requires approval](pim-resource-roles-approval-workflow.md) to acti
6060

6161
You can view the status of your pending requests to activate. It is important when your requests undergo approval of another person.
6262

63-
1. Sign in to the [Azure portal](https://portal.azure.com).
63+
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
6464

65-
1. Select **Azure AD Privileged Identity Management -> My requests -> Groups**.
65+
1. Browse to **Identity governance** > **Privileged Identity Management** > **My requests** **Groups**.
6666

6767
1. Review list of requests.
6868

@@ -71,9 +71,9 @@ You can view the status of your pending requests to activate. It is important wh
7171

7272
## Cancel a pending request
7373

74-
1. Sign in to the [Azure portal](https://portal.azure.com).
74+
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
7575

76-
1. Select **Azure AD Privileged Identity Management -> My requests -> Groups**.
76+
1. Browse to **Identity governance** > **Privileged Identity Management** > **My requests** **Groups**.
7777

7878
:::image type="content" source="media/pim-for-groups/pim-group-8.png" alt-text="Screenshot of where to select the request you want to cancel." lightbox="media/pim-for-groups/pim-group-8.png":::
7979

@@ -83,4 +83,4 @@ When you select **Cancel**, the request is canceled. To activate the role again,
8383

8484
## Next steps
8585

86-
- [Approve activation requests for group members and owners](groups-approval-workflow.md)
86+
- [Approve activation requests for group members and owners](groups-approval-workflow.md)

0 commit comments

Comments
 (0)