You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The Conditional Access optimization agent helps you ensure all users are protected by policy. It recommends policies and changes based on best practices aligned with Zero Trust and Microsoft learning.
2
2
3
-
The Conditional Access optimization agent evaluates policies such as requiring multifactor authentication (MFA). The agent will enforce device based controls (device compliance, app protection policies, and domain-joined devices). Finally, the agent can help block legacy authentication and device code flow.
3
+
The Conditional Access optimization agent evaluates policies such as requiring multifactor authentication (MFA). The agent enforces device based controls (device compliance, app protection policies, and domain-joined devices). Finally, the agent can help block legacy authentication and device code flow.
4
4
5
5
The agent also evaluates all existing enabled policies to propose potential consolidation of similar policies.
6
6
7
7
### Requirement to use the Conditional Access optimization agent
8
8
9
9
- You must have at least the **Microsoft Entra ID P1 license**.
10
-
- You must have available **security compute units (SCU)**.
10
+
- You must have available **Security Compute Units (SCU)**.
11
11
- To activate the agent the first time, you need the Security Administrator or higher role.
12
12
- You can assign Conditional Access Administrators with Security Copilot access.
13
13
- For more information, see Assign Security Copilot access
@@ -34,10 +34,10 @@ In this exercise, you explore key capabilities in the Conditional Access optimiz
34
34
**As you explore, keep in mind that unless otherwise stated, the information displayed and the configuration settings are for the currently logged in Security Administrator**.
35
35
36
36
> [!NOTE]
37
-
> The environment for this exercise is a simulation generated from the product. As a limited simulation, not all links on a page are enabled and text-based inputs that fall outside of the specified script are not supported. A pop-up message displays stating, "This feature isn't available within the simulation." When this occurs, select OK and continue the exercise steps.
37
+
> The environment for this exercise is a simulation generated from the product. As a limited simulation, not all links on a page are enabled and text-based inputs that fall outside of the specified script aren't supported. A pop-up stating, "This feature isn't available within the simulation" message displays. When you receive this message, select OK and continue the exercise steps.
38
38
>
39
39
>
40
-
>:::image type="content" source="../media/simulation-pop-up-error.png" alt-text="Screenshot of pop-up screen indicating that this feature is not available within the simulation.":::
40
+
>:::image type="content" source="../media/simulation-pop-up-error.png" alt-text="Screenshot of pop-up screen indicating that this feature isn't available within the simulation.":::
41
41
42
42
### Exercise
43
43
@@ -46,92 +46,92 @@ For this exercise, you're logged in as Avery Howard and have the Copilot owner r
46
46
This exercise should take approximately **30** minutes to complete.
47
47
48
48
> [!NOTE]
49
-
> When a lab instruction calls for opening a link to the simulated environment, it is generally recommended that you open the link in a new browser window so that you can simultaneously view the instructions and the exercise environment. To do so, select the right mouse key and select the option.
49
+
> When a lab instruction calls for opening a link to the simulated environment, it's recommended that you open the link in a new browser window so that you can simultaneously view the instructions and the exercise environment. To do so, select the right mouse key and select the option.
50
50
51
51
52
52
53
53
1. Open [https://Entra.Microsoft.com (simulation)](https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapp.highlights.guide%2Fstart%2F673ccf96-b6de-43aa-b267-5c8efe51639c%3Ftoken%3D16d48b6c-eace-4a1f-8050-098d29d23a89&data=05%7C02%7CRobert.Stewart%40microsoft.com%7C002283d502a5447b6fc608ddb25b8a73%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638862828426563227%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=krYm%2BX%2FduKbjtZI5t27fNvWrdUIw2Vj2Ufta3fJpB0o%3D&reserved=0&azure-portal=true) with at least the Security Administrator role.
54
54
55
55
2. Launch the Security Copilot Agents screen:
56
-
- Option-1: Select the "Try Security Copilot" agents free for 60 days
56
+
- Option-1: Select the **Try Security Copilot** agents free for 60 days
57
57
- Option-2: Open Conditional Access from the menu on the left. Then select the Conditional Access Optimization agent.
58
58
59
59
### Option-1:
60
-
1. Select the “free 60 day trial” button.
61
-
2. Select “View Details” on the page:
60
+
1. Select the "free 60 day trial" button.
61
+
2. Select **View Details** on the page:
62
62
63
63
### Option-2:
64
-
1. Open the “Conditional Access” item in the left-side menu.
65
-
2. On the “Overview” tab, select “Conditional Access Optimization Agent”.
64
+
1. Open the **Conditional Access** item in the left-side menu.
65
+
2. On the **Overview** tab, select **Conditional Access Optimization Agent**.
66
66
67
67
### Exploring the Conditional Access Agent
68
68
69
-
1. Review the “Overview” tab.
69
+
1. Review the **Overview** tab.
70
70
71
71
- Agent is active – Note the last time the agent ran and the upcoming schedule.
72
-
- Performance highlights – Review the cost in SCUs for the agent. See how many unprotected users the agent has found to protect.
72
+
- Performance highlights – Review the cost in Security Compute Units (SCUs) for the agent. See how many unprotected users the agent found to protect.
73
73
- About this agent – Quick description of the agent and how it works.
74
74
- Recent suggestions – Review of all existing Conditional Access policies and suggestions on how they could be merged, updated, removed, or enhanced.
75
75
- Recent Activity – Status on the last few attempts of the Conditional Access Optimization Agent to run, and the results.
76
76
77
-
2. In the “Agent is active” box select the “View run” link.
77
+
2. Select the **View run** link within the **Agent is active** box..
78
78
79
79
3. Review the process flow of the agent and see what new information was detected since the last completion.
80
80
- Take note that is search for three common access rights optimizations:
81
81
- App / Application drift – new applications were deployed and need to be protected.
82
82
- User drift – new users were found, or user rights changed that leave them unprotected by policy.
83
83
- Policy merge – places where 2 or more policies could be merged to provide the same result, with easier management.
84
84
85
-
4. Select the breadcrumb Conditional Access Optimization Agent (Preview) at the top of the page to return to the Overview page.
85
+
4. Select the breadcrumb **Conditional Access Optimization Agent** to return to the Overview page.
86
86
87
-
5. Select the Activities tab in the top menu. Review the history of when the Conditional Access Optimization agent has run and the results.
87
+
5. Select the Activities tab in the top menu. Review the history of when the Conditional Access Optimization agent ran and the results.
88
88
89
-
6. Select several different “View activity” buttons on the right of the screen to see the progression of the Conditional Access Optimization agent as it runs each 24-hour period.
89
+
6. Select several different **View activity** buttons to see the progression of the Conditional Access Optimization agent as it runs each 24-hour period.
90
90
91
-
7. Open the second item on the list. Note that 4 new applications were found, and recommended policy changes over time.
91
+
7. Open the second item on the list. Notice, four new applications were found, and recommended policy changes over time.
92
92
93
93
8. Use the breadcrumbs to return to the Overview page.
94
94
95
-
9. Select the “Suggestions” from the tab menu.
95
+
9. Select the **Suggestions** from the tab menu.
96
96
97
-
10. Explore the suggestion history. You have one item for each day the agent has been run.
97
+
10. Explore the suggestion history. You have one item for each day the agent ran.
98
98
99
-
11. Select the “Review suggestion” button for the first item.
99
+
11. Select the **Review suggestion** button for the first item.
100
100
101
-
12. Note the policy wants to add 2 users to an existing Conditional Access policy to add users to CA99 – Mitigate Risk Users with Password Reset policy.
101
+
12. Notice, the policy wants to add 2 users to an existing Conditional Access policy. The goal is to add users to CA99 – Mitigate Risk Users with Password Reset policy.
102
102
103
-
13. Select the “Policy impact” tab at the top of the page to see a graph of this policy change over time.
103
+
13. Select the **Policy impact** tab at the top of the page to see a graph of this policy change over time.
104
104
105
-
14. Switch back to the “Policy details” tab, then Select the “Review policy changes” to see the proposed changes and the JSON update to be made.
105
+
14. Switch back to the **Policy details** tab, then Select the “Review policy changes” to see the proposed changes and the JSON update to be made.
106
106
107
-
15. Use the “Back” button in the browser to return to the Overview page.
107
+
15. Use the browser **Back** button to return to the **Overview** page.
108
108
109
-
16. Select “Suggestions” from the menu.
109
+
16. Select **Suggestions** from the menu.
110
110
111
111
17. Select the “x” in the upper right of the screen to close the dialog.
112
112
113
113
### Explore Conditional Access Optimization Agents in CA-Policies
114
114
115
115
1. Open Conditional Access from the menu on the left.
116
116
117
-
2. Select “Policies” from the CA menu.
117
+
2. Select **Policies** from the Conditional Access menu.
118
118
119
119
3. Review the list of policies, you should see three types:
120
120
121
121
- Microsoft – global policies sent out by Microsoft, like require MFA.
122
-
- User – conditional access polices created by an authorized user in your organization.
122
+
- User – conditional access policies created by an authorized user in your organization.
123
123
- Conditional Access Optimization Agent – Report Only policies created by the agent for your review. You can choose to apply them depending on business and security goals.
124
124
125
125
4. Scroll down the list to find the CA99 policy we reviewed earlier.
126
126
127
-
5. Select the “New agent suggestion” item.
127
+
5. Select the **New agent suggestion** item.
128
128
129
-
6. Note that on four occasions the Conditional Access Optimization agent found new user, and has an “Apply suggestion” for each.
129
+
6. On four occasions the Conditional Access Optimization agent found new user, and has an **Apply suggestion** for each.
130
130
131
131
7. Read over the description of what the suggestion is going to do.
132
132
133
133
8. Select the “Apply suggestion” button.
134
134
135
-
**Result** – The agent, has monitored your users each day and found users that we not protected by Risky User policies. It suggested that you update your policy to include the new users, and provided you with a button to make the change. In one button you have protected the users.
135
+
**Result** – The agent, monitors your users each day and found users that were not protected by Risky User policies. It suggested you update your policy to include the new users, and provided you with a button to make the change. In one button you added protection for the users.
136
136
137
-
9. Exit out to Microsoft Entra to finish the simulation.
0 commit comments