You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Conditional Access app control known limitations | Microsoft Defender for Cloud Apps
3
-
description: Learn about known limitations for working with Microsoft Defender for Cloud Apps Conditional Access app control.
3
+
description: Learn about known limitations for working with Conditional Access app control in Microsoft Defender for Cloud Apps.
4
4
ms.date: 01/23/2024
5
5
ms.topic: how-to
6
6
---
7
7
8
-
# Conditional Access app control known limitations
8
+
# Known limitations in Conditional Access app control
9
9
10
-
This article describes known limitations for working with Microsoft Defender for Cloud Apps Conditional Access app control.
10
+
This article describes known limitations for working with Conditional Access app control in Microsoft Defender for Cloud Apps.
11
11
12
12
To learn more about security limitations, contact our support team.
13
13
14
14
## Maximum file size for session policies
15
15
16
-
Session policies can be applied on files with a maximum size of 50 MB. For example, this maximum file size is relevant when you're defining policies to monitor file downloads from OneDrive, block file updates, or block downloads or uploads of malware files.
16
+
You can apply session policies on files that have a maximum size of 50 MB. For example, this maximum file size is relevant when you're defining policies to monitor file downloads from OneDrive, block file updates, or block downloads or uploads of malware files.
17
17
18
-
In cases such as these, make sure to cover files that are larger than 50 MB using the tenant settings to determine whether the file is allowed or blocked, regardless of any matching policies.
18
+
In cases like these, be sure to cover files that are larger than 50 MB by using the tenant settings to determine whether the file is allowed or blocked, regardless of any matching policies.
19
19
20
-
In Microsoft Defender XDR, select **Settings > Conditional Access App Control > Default behavior** to manage settings for files of over 50 MB.
20
+
In Microsoft Defender XDR, select **Settings** > **Conditional Access App Control** > **Default behavior** to manage settings for files that are larger than 50 MB.
21
21
22
-
## Maximum file size for session policies based on information protection content inspection
22
+
## Maximum file size for session policies based on content inspection
23
23
24
-
When a session policy to block file uploads or downloads based on information protection content inspection is applied, inspection is performed on only files smaller than 30 MB and with fewer than 1 million characters.
24
+
When you apply a session policy to block file uploads or downloads based on content inspection, the inspection is performed only on files that are smaller than 30 MB and that have fewer than 1 million characters.
25
25
26
26
For example, you might define one of the following session policies:
27
27
28
-
-Block file upload for files containing Social Security Number (SSN)
29
-
-Protect file download for files containing PHI (Protected Health Information)
30
-
-Block file download for with sensitivity label “very sensitive”
28
+
-**Block upload of files that contain Social Security numbers**
29
+
-**Protect download of files that contain protected health information**
30
+
-**Block download of files that have a sensitivity label of "very sensitive"**
31
31
32
-
In such cases, files larger than 30 MB or with more than 1 million characters aren't scanned. These files are treated according to the **Always apply the selected action even if the data cannot be scanned** policy setting.
32
+
In such cases, files that are larger than 30 MB or that have more than 1 million characters aren't scanned. These files are treated according to the **Always apply the selected action even if the data cannot be scanned** policy setting.
33
33
34
34
The following table lists more examples of files that are and aren't scanned:
35
35
36
-
|File description |Scanned / Not scanned |
36
+
|File description |Scanned |
37
37
|---------|---------|
38
-
|**A TXT file**, 1-MB size and 1 million characters | Scanned |
39
-
|**A TXT file**, 2-MB size and 2 million characters | Not scanned |
40
-
|**A Word file** composed of images and text, 4-MB size and 400-K characters | Scanned |
41
-
|**A Word file** composed of images and text, 4-MB size and 2 million characters | Not scanned |
42
-
|**A Word file** composed of images and text, 40-MB size and 400-K characters | Not scanned |
38
+
|A TXT file, 1-MB size and 1 million characters |Yes|
39
+
|A TXT file, 2-MB size and 2 million characters |No|
40
+
|A Word file composed of images and text, 4-MB size and 400K characters | Yes|
41
+
|A Word file composed of images and text, 4-MB size and 2 million characters |No|
42
+
|A Word file composed of images and text, 40-MB size and 400K characters |No|
43
43
44
-
## Files encrypted with sensitivity labels are not supported
45
-
For tenants that enable co-authoring for files encrypted with sensitivity labels:
46
-
A session policy to block file uploads\download that relies on label filters or file content will operate based on the policy settings of ‘Always apply the selected action even if data cannot be scanned’, in case of file with encrypted sensitivity label.
44
+
## Files encrypted with sensitivity labels
47
45
48
-
For example:
49
-
When a session policy is configured to prevent downloading files that contain credit card numbers and set to ‘Always apply the selected action even if data cannot be scanned’:
50
-
Any file with an encrypted sensitivity label will be blocked from downloading, regardless of its content.
46
+
For tenants that enable coauthoring for files encrypted with sensitivity labels, a session policy to block file upload/download that relies on label filters or file content will operate based on the **Always apply the selected action even if data cannot be scanned** policy setting.
47
+
48
+
For example, assume that a session policy is configured to prevent downloading files that contain credit card numbers and is set to **Always apply the selected action even if data cannot be scanned**. Any file with an encrypted sensitivity label is blocked from downloading, regardless of its content.
51
49
52
50
## External B2B users in Teams
53
51
54
-
External B2B collaboration users are not protected by session policies in Teams application.
52
+
Session policies don't protect external business-to-business (B2B) collaboration users in Microsoft Teams applications.
55
53
56
-
## Limitations for sessions served by reverse proxy
54
+
## Limitations for sessions that the reverse proxy serves
57
55
58
-
This section lists limitations that apply only on sessions that are served by the reverse proxy. Users of Microsoft Edge can benefit from in-browser protection instead of using the reverse proxy, and therefore aren't affected by these limitations.
56
+
The following limitations apply only on sessions that the reverse proxy serves. Users of Microsoft Edge can benefit from in-browser protection instead of using the reverse proxy, so these limitations don't affect them.
59
57
60
58
### Built-in app and browser plug-in limitations
61
59
62
-
Defender for Cloud Apps Conditional Access app control modifies underlying application code and therefore doesn't currently support built-in apps or browser extensions.
60
+
Conditional Access app control in Defender for Cloud Apps modifies underlying application code. It doesn't currently support built-in apps or browser extensions.
63
61
64
-
As an administrator, you might want to define default system behavior for when a policy can't be enforced, choosing to either allow access or totally block it.
62
+
As an administrator, you might want to define default system behavior for when a policy can't be enforced. You can choose to either allow access or totally block it.
65
63
66
64
### Context loss limitations
67
65
68
-
In the following applications, we encountered scenarios where navigating to a link might result in loss of the full path of the link and typically the user lands on the home page of the app:
66
+
In the following applications, we encountered scenarios where browsing to a link might result in loss of the link's full path. Typically, the user lands on the home page of the app.
69
67
70
68
- ArcGIS
71
69
- GitHub
@@ -77,21 +75,21 @@ In the following applications, we encountered scenarios where navigating to a li
77
75
78
76
### File upload limitations
79
77
80
-
If a session policy to block or monitor the upload of sensitive files is applied, then in the following scenarios the user's attempts to upload files or folders using **drag & drop** blocks the complete list of files and folders:
78
+
If you apply a session policy to block or monitor the upload of sensitive files, the user's attempts to upload files or folders by using a drag-and-drop operation block the complete list of files and folders in the following scenarios:
81
79
82
80
- A folder that contains at least one file and at least one subfolder
83
81
- A folder that contains multiple subfolders
84
82
- A selection of at least one file and at least one folder
85
83
- A selection of multiple folders
86
84
87
-
The following table lists example results when the *Block upload of files containing PII to OneDrive* policy is defined:
85
+
The following table lists example results when you define the **Block upload of files that contain personal data to OneDrive** policy:
88
86
89
-
|Scenario |Result|
87
+
|Scenario |Result |
90
88
|---------|---------|
91
-
|A user tries to upload a selection of 200 nonsensitive files using drag anddrop. |Files are blocked|
92
-
|A user tries to upload a selection of 200 files, some are sensitive, and some aren't, using the file upload dialog. | Mon-sensitive files are uploaded <br><br>Sensitive files are blocked|
93
-
|A user tries to upload a selection of 200 files, some are sensitive, and some aren't, using drag and drop. |The full set of files is blocked|
89
+
|A user tries to upload a selection of 200 nonsensitive files by using a drag-and-drop operation. |Files are blocked.|
90
+
|A user tries to upload a selection of 200 files by using the file upload dialog. Some are sensitive, and some aren't. |Nonsensitive files are uploaded. <br><br>Sensitive files are blocked.|
91
+
|A user tries to upload a selection of 200 files by using a drag-and-drop operation. Some are sensitive, and some aren't. |The full set of files is blocked.|
94
92
95
93
## Related content
96
94
97
-
-[Microsoft Defender for Cloud Apps Conditional Access app control](proxy-intro-aad.md)
95
+
-[Conditional Access app control in Microsoft Defender for Cloud Apps](proxy-intro-aad.md)
0 commit comments