One of the nice features of Intune (and to a greater extent, Azure Active Directory), is the ability to apply conditional access rules to ensure users only access the resources you want them to on the devices and locations you have approved.<\/p>\n
What is Conditional Access?<\/h2>\n
Conditional Access is the ability to restrict who, what, where, why, and how your users and devices are accessing your organizational resources.<\/p>\n
Let\u2019s say you only want users whose devices are managed by Intune to be able to access any Office 365 resource. You can easily define a rule for that.<\/p>\n
How can I define a Conditional Access Rule?<\/h2>\n
There are two places where you can define a “Conditional Access” rule in Azure.<\/p>\n
# 1 – You can access it through the Azure Active Directory Blade, or the Intune Blade.<\/p>\n
For this example, I just accessed Conditional Access through the Intune Blade. Our first step will be to create a new “Rule” and name it. (I called my rule \u201cConditional Access Policy.\u201d Very creative, right?)<\/p>\n
As you can see in the picture above, there two main sections, \u201cAssignments\u201d (this is the who, what, when, and where of the policy), and \u201cAccess Controls\u201d (the why and how of the policy). These two main sections are divided up into subsections.<\/p>\n Each of these will be covered next:<\/p>\n This section is pretty self-explanatory, as this is the \u201cwho\u201d portion of the policy.<\/p>\n What users or groups should this policy be applied to? Or, who should be excluded from receiving this policy? See below:<\/p>\n This is the \u201cwhat\u201d portion of the conditional access policy.<\/p>\n What cloud applications are you trying to restrict users from accessing if they do not meet requirements outlined in the rules? Natively, this option will include (or exclude) all of the major Office 365 applications (Exchange, SharePoint, Groups, Teams…).<\/p>\n But it will also allow you to restrict any cloud apps that have been connected through Azure Active Directory:<\/p>\n This is the where and when a portion of the policy. From this setting we can define the following sub-sections:<\/p>\n Do you want this policy to only apply to Android devices? What about just devices running Windows?<\/p>\n From this section, you can include and exclude Android devices, iOS devices, Windows devices or Mac devices.<\/p>\n If your users are located on the local Intranet, is conditional access something they\u00a0really\u00a0<\/i>need to have applied to them?<\/p>\n Also, if you are not worried about devices inside of your firewall, you can use this setting to include or exclude devices that come from trusted IP addresses.<\/p>\n Maybe you are only interested in restricting access to devices accessing resources from a browser. Or maybe only devices using mobile or desktop apps.<\/p>\n From this screen, you can define the type of application that users are restricted from using:<\/p>\n (NOTE: In the screenshot above, you will notice the blue banner notifying us that \u201cLegacy auth is currently not supported.\u201d This applies to apps like Native iOS or Android Mail.<\/i>)<\/p>\n This is the why and how portion of our policy.<\/p>\n Are you granting or blocking access? Do your users need to go through MFA first? If the devices are managed by Intune, do they need to be compliant in the Intune portal first?<\/p>\n You can define those options in this section:<\/p>\n![\"\"](\"https:\/\/centricconsulting.com\/wp-content\/uploads\/2018\/07\/Intune_1.png\")
<\/a><\/p>\nUsers and Groups<\/h3>\n
![\"\"](\"https:\/\/centricconsulting.com\/wp-content\/uploads\/2018\/07\/Users-and-Groups.png\")
<\/a><\/p>\nCloud Apps<\/h3>\n
![\"\"](\"https:\/\/centricconsulting.com\/wp-content\/uploads\/2018\/07\/Cloud-Apps.png\")
<\/a><\/p>\nConditions<\/h2>\n
Device Platforms<\/h3>\n
![\"\"](\"https:\/\/centricconsulting.com\/wp-content\/uploads\/2018\/07\/Device-Platforms.png\")
<\/a><\/p>\nLocations<\/h3>\n
![\"\"](\"https:\/\/centricconsulting.com\/wp-content\/uploads\/2018\/07\/Locations.png\")
<\/a><\/p>\nClient Apps<\/h3>\n
![\"\"](\"https:\/\/centricconsulting.com\/wp-content\/uploads\/2018\/07\/Client-Apps.png\")
<\/a><\/p>\nGrant<\/h2>\n
![\"\"](\"https:\/\/centricconsulting.com\/wp-content\/uploads\/2018\/07\/Grant.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/centricconsulting.com\/wp-content\/uploads\/2018\/07\/Session.png\")
<\/a><\/p>\n