Skip to content

Update entra-conditional-access-policy.md #364

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: public
Choose a base branch
from
Open

Update entra-conditional-access-policy.md #364

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion defender-for-cloud-apps/includes/entra-conditional-access-policy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,13 @@ For more information, see [Conditional Access policies](/azure/active-directory/
To protect your SaaS applications with Session Controls, you must allow access to this application.
>
>If you have any Conditional Access policies that have **“Block Access”** selected in the **“Grant Access”** Control under a Microsoft Entra ID Conditional Access policy scoped to this app, end users will not be able to access the protected applications under session controls. <br><br>
>It's important to ensure that this application isn't unintentionally restricted by any Conditional Access policies. For policies that restrict all or certain applications, please ensure this application is listed as an exception in the **Target resources** or confirm that the blocking policy is deliberate.<br>
>It's important to ensure that this application isn't unintentionally restricted by any Conditional Access policies. For policies that restrict all or certain applications, please ensure this application is listed as an exception in the **Target resources** or confirm that the blocking policy is deliberate.
>
>You may need to add create the following service principal to make the app available in the Conditional Access app picker.
># Connect with the appropriate scopes to create service principal
Connect-MgGraph -Scopes "Application.ReadWrite.All"

# Create service principal for the service **Microsoft Defender for Cloud Apps - Session Controls**
New-MgServicePrincipal -AppId 8a0c2593-9cbc-4f86-a247-beb7aab00d83<br>
>
>To ensure your location-based conditional access policies function correctly, include the **Microsoft Defender for Cloud Apps – Session Controls** application in those policies.