[MUSIC]
Caleb Baker: Hi. Well, hopefully, you’ve seen the last video
talking about what is conditional access? In this video, we’re
really going to talk about how you would configure and how
you would apply a conditional access policy, walking through
a few different examples and a few different use cases.
The first example that I’m going to show is how you would
apply a strong authentication or multi-factor authentication
policy when signing into Office 365.
Now, as a first step, I’m going to sign into the Azure portal
and go to the Azure AD blade.
Then from this blade, I can navigate under the security
settings and open up conditional access policies. Now, I’ve
already created the policies that we’re going to be looking
at, but I can walk through them and show you what I’ve done
and call out some key points. Now, I’ve set up this require
strong authentication policy. And when I open this up, this
will really map back to that diagram that I showed on the
previous video, talking about what conditional access policy
is, where there’s the two parts of the policy conditions and
controls, when the policy is applied, and what does it do?
So in the assignments and conditions, is when this policy is
going to be applied. And I’ve configured user targeting here.
Now, you have several different options of how you want to
be able to do this targeting. You could apply it to guest
users based on specific Azure AD roles like Global Admins
or targeting specific users and groups.
To start out with, I’m going to apply this policy to Frank.
Now, another key part of this policy is which applications
this applies to, and I’ve selected several of the Microsoft
Office 365 offerings and the applications here, which is a
recommended practice to be able to have a consistent
policy across these apps to provide both the most consistent
user experience and also to secure the applications.
Now, I go under conditions to do some additional configuration
here. Now in this policy, I’m going to start out by only
requiring multi-factor authentication for users who are outside
the corporate network. And I can do that by going to the
location condition. Now when I open that up, I can say this
policy is going to trigger for a user coming from any location
and then I can exclude the trusted locations. And these would
be locations that I’d gone in that I would’ve configured with
a trusted egress IP ranges from my network.
The other really important condition to configure here is for
cloud apps. Now, what this does is it specifies which
applications this policy’s going to apply to and that covers
browser, mobile, and then also other clients, which would
be older, legacy clients like older versions of office or some
third party apps as well. And tis makes sure that you have
full coverage across all different access points to the data.
Now that we’ve gone through and said when this policy’s
going to apply, we’re going to say what it does. And you can
do that through the access controls under the grants. In
this case, it’s pretty straightforward. I’m just going to say
require a multi-factor authentication. As the last step, I
enable the policy and then you would close and save.
Now, that’s about making sure it’s the right user who’s able
to access data, but I also want to make sure that when that
data comes down onto a device that it stays secure. And I’ll
do that by making sure that the device that it’s going to is
a device that I trust and a device that I can manage.
All of the configuration is the same in terms of when I want
to trigger this policy. But I’m adding some additional controls
here. Under the controls, I’m saying the requirement is to
have a compliant device, this would be a compliant device
that’s been evaluated by Intune or SCCM, as well as requiring
a hybrid Azure AD Join device. This is a device that’s been
joined to your on-premise AD and then also has been registered
within Azure Active Directory. Okay. And the other important
thing to call out here, what this illustrates is when you do have
multiple controls, you also have the option to say how you
want them to interact. In this case, I’ve said require one of
the selected controls. That means I know that I have a
compliant device that’s managed or I have a machine that’s
joined to my on-prem AD that I can use some other technique
for managing like a group policy.
Now, a really common question is when you have multiple
policies like this, a trusted device, and a strong auth policy,
where all the scoping is the same, same user, same
application, how do they combine together which takes
precedence? And when we have these sort of configurations,
it’s really all policies are applied. So in this case, there’s
effectively an and between these. These are has to perform
strong authentication and they have to have a trusted device.
And to have that trusted device, it could be compliant or
domain joined.
The third policy really illustrates some deeper integration
that we’ve done with other services. And this is going to be
about keeping people productive, getting access to data,
even if they’re not necessarily on a work owned device that
they’ve enrolled and fully managed. Instead, what you can
do using Microsoft Cloud App Security or using native
integrations within SharePoint and Exchange, you can create
a session policy. And when this session policy is triggered
using all the same controls, it’ll apply a restriction that when
you get into that app, you get into SharePoint Online or you
get into Workday through Cloud App Security, that when you
do a file download, that it does a check to see if you’re on
a compliant device. If you’re not, then it’s blocked. It keeps
all the data in the cloud in that web experience. And this is
a way to allow people to get access to data without storing it
on your device and possibly compromising that information.
Now when you’re using Cloud App Security, you have other
options and controls here as well too beyond what’s the
quick options here. Now, the quick options are being able
to opt in and just be able to have monitoring all traffic,
so you can see what’s someone’s doing when they’re going
to say Workday or that block down download option that I
had mentioned. Creating the custom policy gives you a bit
more power, where you can go in and create something that
fits your organization like making sure documents get
encrypted with specific labels using Azure Information
Protection on download.
Now, really across the board conditional access policy
provides a rich set of integrations and a rich set of controls
you’re able to use in order to achieve zero trust within your
organization.
Alright, hopefully that’s give you a good overview of what you
can do with conditional access policies. You can configure the
policies in order to achieve a zero trust posture for your
organization and keep your data secure in the cloud. Next
time, we’ll be talking about how you would roll out and
monitor some of these policies and manage conditional access.
Thanks.
[MUSIC]