Scenario: Anyone using MCAS, Conditional Access, Window 10 Endpoints and Google Chrome.
Challenge: How do you get Google Chrome to be recognised by Azure Conditional Access policies.
Issue : Azure Sign In’s, by default will not see Google Chrome as Azure AD Joined.
Browser = Chrome & Joined Type = [Blank]
However, by default Microsoft Edge does report as Azure AD Joined
Browser = Edge & Joined Type = Azure AD Joined
Solution : chrome://extensions/
Conditions in Conditional Access policy – Azure Active Directory | Microsoft Docs
“For Chrome support in Windows 10 Creators Update (version 1703) or later, install the Windows 10 Accounts extension. This extension is required when a Conditional Access policy requires device-specific details.
To automatically deploy this extension to Chrome browsers, create the following registry key:”
Type REG_SZ (String)
Or Add manually
Extension now appears for Windows 10 Accounts show below
Then the next Azure/265 Sign in with show Azure AD Joined using Google Chrome
How to remove the download, save as or print option from the MS Teams thick client application on unmanaged device, logged into your corporate tenancy via a conditional access policy.
- Create a group : Block_Teams_Thick_Client_Downloads
- Add users to the group you want to block access to download, save as or print.
Create a new conditional access policy – Example : Block Teams Thick Client Downloads
- Users and Groups add “Block_Teams_Thick_Client_Downloads”
- Cloud Apps or Actions – Select Apps – MS Teams
- Conditions – Select Client Apps> Configure >Yes> Tick : Mobile Apps, Exchange and Other Clients. Untick Browser.
- Device state (Currently in preview) > Set exclude > Tick : Hybrid Azure AD joined and Device marked as compliant
- Grant – Select > Block Access and For Multiple controls > “Require one of the selected controls”
Block Access From Unmanaged Devices To SharePoint
From SharePoint Admin Center > Polices > Access Control
Click Unmanaged Devices
Note “To use this setting, get a subscription to Enterprise Mobility + Security and assign a license to yourself. ” See Microsoft Endpoint Manager | Microsoft 365 for more information
Select Block Access > Save
Block Access From Unmanaged Devices To SharePoint Specific Sites and Limit access using PowerShell.
Examples block download, save and print on unmanaged devices for a specific SharePoint site (SharePoint, OneDrive)
Limit access to a single site: Set-SPOSite -Identity https://<SharePoint online URL>/sites/<name of site or OneDrive account> -ConditionalAccessPolicy AllowLimitedAccess
Block access to a single site: Set-SPOSite -Identity https://<SharePoint online URL>/sites/<name of site or OneDrive account> -ConditionalAccessPolicy BlockAccess
Update multiple sites at once: (Get-SPOSite -IncludePersonalSite
$true -Limit all -Filter
“Url -like ‘-my.sharepoint.com/personal/'”) | Set-SPOTenant -ConditionalAccessPolicy AllowLimitedAccess