You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/dev-box/how-to-configure-intune-conditional-access-policies.md
+23-23Lines changed: 23 additions & 23 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
-
title: Intune Conditional Access policies for Dev Boxes
2
+
title: Intune Conditional Access Policies for Dev Boxes
3
3
titleSuffix: Microsoft Dev Box
4
-
description: Learn how to configure Intune conditional access policies to manage access to dev boxes, ensuring that your organization's devices remain secure.
4
+
description: Learn how to configure Intune conditional access policies to manage access to dev boxes to ensure that your organization's devices remain secure.
5
5
services: dev-box
6
6
ms.service: dev-box
7
7
author: RoseHJM
@@ -13,20 +13,20 @@ ms.topic: how-to
13
13
14
14
---
15
15
16
-
# Configure Conditional Access policies for Dev Box
16
+
# Configure conditional access policies for Dev Box
17
17
18
18
Conditional access is the protection of regulated content in a system by requiring certain criteria to be met before granting access to the content. Conditional access policies at their simplest are if-then statements. If a user wants to access a resource, they must complete an action. Conditional access policies are powerful tools to help keep your organization's devices secure and your environments compliant.
19
19
20
20
This article provides examples of how organizations can use conditional access policies to manage access to dev boxes. For Dev Box, it's common to configure conditional access policies to restrict who can access the dev boxes, and from which locations they can access their dev boxes.
21
21
22
-
-**Device-based Conditional Access**
23
-
- Intune and Microsoft Entra ID work together to make sure that only managed and compliant devices can use Dev Box. Policies include Conditional Access based on network access control.
24
-
- Learn more about [device-based Conditional Access with Intune](/mem/intune/protect/create-conditional-access-intune).
22
+
-**Device-based conditional access**
23
+
- Intune and Microsoft Entra ID work together to make sure that only managed and compliant devices can use Dev Box. Policies include conditional access based on network access control.
24
+
- Learn more about [device-based conditional access with Intune](/mem/intune/protect/create-conditional-access-intune).
25
25
26
-
-**App-based Conditional Access**
26
+
-**App-based conditional access**
27
27
28
-
- Intune and Microsoft Entra ID work together to make sure that only dev box users can access managed apps like the developer portal.
29
-
- Learn more about [app-based Conditional Access with Intune](/mem/intune/protect/app-based-conditional-access-intune).
28
+
- Intune and Microsoft Entra ID work together to make sure that only dev box users can access managed apps like the Microsoft developer portal.
29
+
- Learn more about [app-based conditional access with Intune](/mem/intune/protect/app-based-conditional-access-intune).
30
30
31
31
## Prerequisites
32
32
@@ -37,7 +37,7 @@ This article provides examples of how organizations can use conditional access p
37
37
38
38
Your organization might start with conditional access policies that, by default, allow nothing. You can set up a conditional access policy that allows your developers to access their dev boxes by specifying the conditions under which they can connect.
39
39
40
-
You can configure conditional access policies through Intune or through Microsoft Entra ID. Each path brings you to a configuration pane.
40
+
You can configure conditional access policies through Intune or Microsoft Entra ID. Each path brings you to a configuration pane.
41
41
42
42
:::image type="content" source="media/how-to-configure-intune-conditional-access-policies/conditional-access-policy.png" alt-text="Screenshot that shows the options for creating a new conditional access policy.":::
43
43
@@ -49,7 +49,7 @@ You want to allow dev box access, but only from specified networks, like your of
49
49
50
50
Follow these steps:
51
51
52
-
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/) as at least a [Conditional Access administrator](/entra/identity/role-based-access-control/permissions-reference#conditional-access-administrator).
52
+
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/) as at least a [Conditional access administrator](/entra/identity/role-based-access-control/permissions-reference#conditional-access-administrator).
53
53
54
54
1. Browse to **Protection** > **Conditional Access** > **Named locations**.
55
55
@@ -103,7 +103,7 @@ Follow these steps:
103
103
104
104
Confirm that your policy works as expected by using Report-only mode. Confirm that the policy is working correctly, and then enable it.
105
105
106
-
For information on how to configure a conditional access policy to block access, see [Conditional Access: Block access by location](/entra/identity/conditional-access/howto-conditional-access-policy-location).
106
+
For information on how to configure a conditional access policy to block access, see [Conditional access: Block access by location](/entra/identity/conditional-access/howto-conditional-access-policy-location).
107
107
108
108
## Scenario 2: Allow access to the developer portal
109
109
@@ -112,11 +112,11 @@ You want to allow developer access to the developer portal only. Developers shou
112
112
### Create a new policy
113
113
114
114
> [!NOTE]
115
-
> The application Microsoft Developer Portal was renamed from Fidalgo Dev Portal Public, so it's possible for certain tenants to still see the previous name. Even though they see a different name, they still have the same application ID, so it's the correct app. If you want to try fixing this naming problem, delete and re-add the tenant's service principal for the app.
115
+
> The application Microsoft Developer Portal was renamed from Fidalgo Dev Portal Public, so it's possible for certain tenants to still see the previous name. Even though they see a different name, they still have the same application ID, so it's the correct app. If you want to try fixing this naming problem, delete and readd the tenant's service principal for the app.
116
116
117
117
Follow these steps:
118
118
119
-
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/) as at least a [Conditional Access administrator](/entra/identity/role-based-access-control/permissions-reference#conditional-access-administrator).
119
+
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/) as at least a [Conditional access administrator](/entra/identity/role-based-access-control/permissions-reference#conditional-access-administrator).
120
120
121
121
1. Browse to **Protection** > **Conditional Access** > **Policies**.
122
122
@@ -149,28 +149,28 @@ The following table describes the apps that are relevant for Dev Box. You can cu
| Windows 365 | 0af06dc6-e4b5-4f28-818e-e78e62d137a5 | Used when Microsoft Remote Desktop is opened to retrieve the list of resources for the user, and when users initiate actions on their dev box, like Restart. |
152
-
| Azure Virtual Desktop | 9cdead84-a844-4324-93f2-b2e6bb768d07 | Used to authenticate to the Gateway during the connection and when the client sends diagnostic information to the service. Might also appear as Windows Virtual Desktop. |
152
+
| Azure Virtual Desktop | 9cdead84-a844-4324-93f2-b2e6bb768d07 | Used to authenticate to the gateway during the connection and when the client sends diagnostic information to the service. Might also appear as Windows Virtual Desktop. |
153
153
| Microsoft Remote Desktop | a4a365df-50f1-4397-bc59-1a1564b8bb9c | Used to authenticate users to the dev box. Only needed when you configure single sign-on in a provisioning policy. |
154
154
| Windows Cloud sign-in | 270efc09-cd0d-444b-a71f-39af4910ec45 | Used to authenticate users to the dev box. This app replaces the Microsoft Remote Desktop app. Only needed when you configure single sign-on in a provisioning policy. |
155
155
| Windows Azure Service Management API | 797f4846-ba00-4fd7-ba43-dac1f8f63013 | Used to query for DevCenter projects where the user can create dev boxes. |
156
-
| Fidalgo Dataplane Public | e526e72f-ffae-44a0-8dac-cf14b8bd40e2 | Used to manage dev boxes and other DevCenter resources via the DevCenter REST APIs, the Azure CLI, or the Dev Portal. |
157
-
| Microsoft Developer Portal| 0140a36d-95e1-4df5-918c-ca7ccd1fafc9 | Used to sign in to the developer portal web app. |
156
+
| Fidalgo Dataplane Public | e526e72f-ffae-44a0-8dac-cf14b8bd40e2 | Used to manage dev boxes and other DevCenter resources via the DevCenter REST APIs, the Azure CLI, or the Microsoft developer portal. |
157
+
| Microsoft developer portal| 0140a36d-95e1-4df5-918c-ca7ccd1fafc9 | Used to sign in to the Microsoft developer portal web app. |
158
158
159
-
You can allow apps based on your requirements. For example, you can allow Fidalgo Dataplane Public to allow dev box management by using the DevCenter REST APIs, the Azure CLI, or the Dev Portal. The following table lists the apps that are used in common scenarios.
159
+
You can allow apps based on your requirements. For example, you can allow Fidalgo Dataplane Public to allow dev box management by using the DevCenter REST APIs, the Azure CLI, or the Microsoft developer portal. The following table lists the apps that are used in common scenarios.
160
160
161
161
| App | Sign in to and manage dev boxes in developer portal | Dev box management (create/delete/stop etc.) | Connect through browser | Connect through Remote Desktop |
For more information on how to configure conditional access policies, see [Conditional Access: Users, groups, and workload identities](/entra/identity/conditional-access/concept-conditional-access-users-groups).
170
+
For more information on how to configure conditional access policies, see [Conditional access: Users, groups, and workload identities](/entra/identity/conditional-access/concept-conditional-access-users-groups).
171
171
172
172
## Related content
173
173
174
-
-[Users and groups in Conditional Access policy](/entra/identity/conditional-access/concept-conditional-access-users-groups)
175
-
-[Cloud apps, actions, and authentication context in Conditional Access policy](/entra/identity/conditional-access/concept-conditional-access-cloud-apps)
176
-
-[Network in Conditional Access policy](/entra/identity/conditional-access/concept-assignment-network)
174
+
-[Users and groups in conditional access policy](/entra/identity/conditional-access/concept-conditional-access-users-groups)
175
+
-[Cloud apps, actions, and authentication context in conditional access policy](/entra/identity/conditional-access/concept-conditional-access-cloud-apps)
176
+
-[Network in conditional access policy](/entra/identity/conditional-access/concept-assignment-network)
0 commit comments