[MUSIC]
Caleb Baker: Hello. In this video, we’re going to talk about
what is conditional access and how you can use it within your
organization to help keep your data secure.
My name is Caleb Baker. I’m a Program Manager on the Azure
AD team working primarily on conditional access.
Now, conditional access policy is really a next gen policy
that’s built for the cloud. It’s able to take in a lot of data, a
lot of contextual data from a user sign in flow and make sure
that the right controls are enforced. Now, the old world of
walled gardens, having your secure network perimeter just
doesn’t really work anymore, not with people wanting to
work from anywhere, being able to connect to all sorts of
cloud applications. So, there needs to be a new answer and
this is where we talk about identity is the control plane.
Now, everything pivots around that user identity. You know
what their activities are. You know what devices, locations
that they’re using. And then we leverage that information
in conditional access policy to be able to enforce things like
multi-factor authentication or require a compliant device.
You can see how conditional access policy’s really broken up
into two pieces. There are the conditions, which is when the
policy is going to apply. This can be, again, the location, type
of application that you’re on, any detected risk. And that risk
is really interesting because that’s something that we get
from all of the analysis and Intel that we have across
organizations using Azure Active Directory, as well as our
consumer identity offerings, tons more data than any
individual organization can have. And then we can use that
to inform a smart, risk based access decisions, access decisions
based on risk or things configured by location or app. You then
can say what the result of that policy is going to be. And that
could be a requirement to have multi-factor authentication,
to require a compliant device or trigger other actions.
Now when you create these policies, they can be applied for
any of the applications that are part of Azure AD. Of course,
that includes Office 365 and Azure applications but then also
third party apps and SaaS applications or line of business
applications that have federated authentication with Azure AD.
And it even reached back on-prem using the Azure App Proxy,
where you can control access to your on-prem environment
and some older deployments that you might have.
The other really powerful thing about conditional access
policy is that it plays this nice supporting role within Microsoft
365, where as the sort of policy conductor that you have all
these inputs and controls that you can enforce, it integrates in
with a matrix of different offerings from M365, like Microsoft
Intune for that device health, polling risk signals and having
those integrated in through Azure Identity Protection into
Azure AD, applying policy for Azure Information Protection
or using Microsoft Cloud App Security to help provide a
really rich experience and secure experience going to cloud
apps.
Let’s talk a little bit about some of the higher level use cases
that people use conditional access policy for. One of the
real common ones for people to get started on is just
making sure that their identities are secure. You want to
make sure it’s the right user who’s accessing your information.
And this can be requiring strong authentication or just
requiring strong authentication based on some of those
conditions I mentioned previously, like if you’re outside the
corporate network or if there’s an elevated risk detected,
which really lets you have a fine level of control when you’re
authoring these policies.
Another very common use case is to be able to keep your
data safe, and that means as data goes down onto a device
or into applications, you know that it’s an environment that
it’s not going to leak from or if that device was lost or stolen,
that you’d be able to maintain it and not have someone get
access to it who shouldn’t. And that means that you can
enforce policies like requiring that you have drive encryption
or a set pin length. And this is done by having conditional
access policy work with Intune where Intune does that sort of
device compliance enforcement and then conditional access
policy requires the device be compliant before accessing an
application.
Another common use case people have is just when they
need to satisfy some compliance requirement like blocking
access from outside the corporate network and conditional
access policy allows you to have those controls as well.
Another really common here is you can take advantage of
the terms of use page within conditional access, applying
a policy to say guests who have to agree to some terms of
use before gaining access to your organization.
And as a final key point, that when you configure these
policies, it’s important to us that you can enable the right
security without having a compromise in productivity and
that means making sure that there’s the right level of policy,
right controls necessary based on app sensitivity or conditions
of the session so that you can enforce say data only going
onto a compliant device while still making sure users have
access. And this is done through deeper integration with
apps like SharePoint and Exchange Online as well as through
Microsoft Cloud App Security.
So as you can see, there’s a wide range of benefits that you
can get from conditional access policy and how you would use
it to help secure your organization and help keep your data
safe. Now, I hope this was helpful in explaining what
conditional access policy is and in the next video, we’ll talk
about how you configure some of these policies. Alright.
Thank you.
[MUSIC]