Kim Kischel: In this video, we’ll walk you through one of the
many use cases you can enable using Conditional Access
App Control, our reverse proxy solution that enables
visibility and real-time control of user sessions in risky or
low trust situations. B2B collaboration is extremely common
in most organizations today. While important, it also
introduces security concerns because security admins
have limited visibility and control of external users that
can access the organization’s resources. To mitigate
against such threats, we’ll create a read only mode for
external users that can be applied to any web application
whether created by Microsoft, another SaaS provider, or
a custom app. To do this, you first need to create a
conditional access policy in Azure AD that routes traffic
to Microsoft Cloud App Security.
From the menu bar, navigate to control and select policies.
Now, click on create policy and select session policy from
the dropdown. We’ll name this policy block downloads for
external users. And you also have the option of adding a
description below. The category is DLP, since we’re
preventing data loss and exfiltration. Under session control
type, select control file download with DLP. Under conditions,
specify that this policy should be applied to external users.
In this case, we’ll specify a single external user.
Since we want to apply this to all corporate apps, we don’t
need an app filter. Under controls, select block and
customize the block message to explain to the user that
while they can view the file in their browser, they cannot
download the content to an unmanaged device.
Then click create.
The second policy we want to configure is the ability to
block print, copy, and cut actions. Follow the same steps
as before to create a new policy. We’ll name this policy
read only mode for external users and give it a type of
DLP. Under session control type this time, we’ll select
block activities. We’ll again apply this to the same external
user
and all apps.
The next step is to define the activities that will trigger this
policy. In the custom activities filter, we’ll choose print,
copy, cut. What we’ve just done is created a read only
mode across all of your corporate web apps. Now, let’s
see what it looks like to the end user.
You can see that the user is being redirected to Microsoft
Cloud App Security. Now, the user opens a clearly
sensitive file called employee social security information.
While they can open the file and view it in the browser,
when they download the file, the download is blocked.
Similarly, printing is blocked.
And finally, if they try to copy or cut content, this scenario
is blocked as well.
This enables the user to continue to be productive without
the fear of data exfiltration outside of your organization.