Scenario: Anyone using MCAS, Conditional Access, Window 10 Endpoints and Google Chrome.
Challenge: How do you get Google Chrome to be recognised by Azure Conditional Access policies.
Issue : Azure Sign In’s, by default will not see Google Chrome as Azure AD Joined.
Browser = Chrome & Joined Type = [Blank]
However, by default Microsoft Edge does report as Azure AD Joined
Browser = Edge & Joined Type = Azure AD Joined
Solution : chrome://extensions/
Conditions in Conditional Access policy – Azure Active Directory | Microsoft Docs
“For Chrome support in Windows 10 Creators Update (version 1703) or later, install the Windows 10 Accounts extension. This extension is required when a Conditional Access policy requires device-specific details.
To automatically deploy this extension to Chrome browsers, create the following registry key:”
Type REG_SZ (String)
Or Add manually
Extension now appears for Windows 10 Accounts show below
Then the next Azure/265 Sign in with show Azure AD Joined using Google Chrome
How to remove the download, save as or print option from the MS Teams thick client application on unmanaged device, logged into your corporate tenancy via a conditional access policy.
- Create a group : Block_Teams_Thick_Client_Downloads
- Add users to the group you want to block access to download, save as or print.
Create a new conditional access policy – Example : Block Teams Thick Client Downloads
- Users and Groups add “Block_Teams_Thick_Client_Downloads”
- Cloud Apps or Actions – Select Apps – MS Teams
- Conditions – Select Client Apps> Configure >Yes> Tick : Mobile Apps, Exchange and Other Clients. Untick Browser.
- Device state (Currently in preview) > Set exclude > Tick : Hybrid Azure AD joined and Device marked as compliant
- Grant – Select > Block Access and For Multiple controls > “Require one of the selected controls”
Block Access From Unmanaged Devices To SharePoint
From SharePoint Admin Center > Polices > Access Control
Click Unmanaged Devices
Note “To use this setting, get a subscription to Enterprise Mobility + Security and assign a license to yourself. ” See Microsoft Endpoint Manager | Microsoft 365 for more information
Select Block Access > Save
Block Access From Unmanaged Devices To SharePoint Specific Sites and Limit access using PowerShell.
Examples block download, save and print on unmanaged devices for a specific SharePoint site (SharePoint, OneDrive)
Limit access to a single site: Set-SPOSite -Identity https://<SharePoint online URL>/sites/<name of site or OneDrive account> -ConditionalAccessPolicy AllowLimitedAccess
Block access to a single site: Set-SPOSite -Identity https://<SharePoint online URL>/sites/<name of site or OneDrive account> -ConditionalAccessPolicy BlockAccess
Update multiple sites at once: (Get-SPOSite -IncludePersonalSite
$true -Limit all -Filter
“Url -like ‘-my.sharepoint.com/personal/'”) | Set-SPOTenant -ConditionalAccessPolicy AllowLimitedAccess
Security Defaults in Azure Portal. IMPORTANT, SECURITY DEFAULTS IS NOT ALWAYS ENABLED BY DEFAULT. YOU MUST CHECK YOUR SETTINGS
What does Security Defaults give you? Security Defaults when enabled provide the following preconfigured security settings:
Requiring all users to register for Azure AD Multi-Factor Authentication.
Requiring administrators to perform multi-factor authentication.
Blocking legacy authentication protocols.
Requiring users to perform multi-factor authentication when necessary.
Protecting privileged activities like access to the Azure portal.
Azure Active Directory security defaults | Microsoft Docs
How do you enable? Azure Active Directory > Properties > Manage Security Defaults > Yes > Save
Discovering and blocking legacy auth:
Discovering and blocking legacy authentication in your Azure and Microsoft 365 subscriptions – Jussi Roine
Understanding Modern vs Legacy auth:
Understanding Modern vs. Legacy Authentication in Microsoft 365 – Ru365 (campbell.scot)
Problem : Azure Conditional Access + “New policy” is greyed out.
Reason : To use Azure Conditional Access Policies, you require “Azure AD Premium”
Solution : License and Setup Azure AD Premium. You are able to setup Azure AD Premium on a 30 Day trial before incurring additional costs
Activate using Free 30 day trial option shown below.
Jan 16, 2020
AZ-103: Microsoft Azure ADMINISTRATOR
#Azure #Administrator #CertifiedProfessional #MicrosoftAzure #MicrosoftCloud #Microsoft #alwaysbelearning #AZ103 #EXAM #PASSED