{"id":16397,"date":"2020-08-12T06:38:31","date_gmt":"2020-08-12T06:38:31","guid":{"rendered":"https:\/\/www.testpreptraining.com\/tutorial\/?page_id=16397"},"modified":"2020-08-26T10:35:24","modified_gmt":"2020-08-26T10:35:24","slug":"building-a-conditional-access-policy","status":"publish","type":"page","link":"https:\/\/www.testpreptraining.ai\/tutorial\/building-a-conditional-access-policy\/","title":{"rendered":"Building a Conditional Access policy"},"content":{"rendered":"\n

Go back to AZ-500 Tutorials<\/a><\/p>\n\n\n\n

In this tutorial, we will learn and understand the Conditional Access policy, Assignments, and Access controls. However, a Conditional Access policy brings signals together for making decisions and enforcing organizational policies.<\/p>\n\n\n\n

Requirement for Conditional Access Policy<\/strong><\/h4>\n\n\n\n
\"conditional
Image Source: Microsoft<\/figcaption><\/figure><\/div>\n\n\n\n
Assignments<\/strong><\/h5>\n\n\n\n

The assignments portion is responsible for controlling the who, what, and where of the Conditional Access policy.<\/p>\n\n\n\n

Users and groups<\/strong><\/h5>\n\n\n\n

Users and groups have access for assigning who the policy will include or exclude. Moreover, this assignment can include all users, specific groups of users, directory roles, or external guest users.<\/p>\n\n\n\n

Cloud apps or actions<\/strong><\/h5>\n\n\n\n

Cloud apps or actions have access to include or exclude cloud applications or even user actions that will be subject to the policy.<\/p>\n\n\n\n

Conditions<\/strong><\/h5>\n\n\n\n

A policy can have multiple conditions.<\/p>\n\n\n\n

Sign-in risk<\/strong><\/h5>\n\n\n\n

For organizations with Azure AD Identity Protection, for the risk detections generated there can influence your Conditional Access policies.<\/p>\n\n\n\n

Device platforms<\/strong><\/h5>\n\n\n\n

Organizations with multiple device operating system platforms can enforce specific policies on different platforms. However, the information calculating the device platform comes from unverified sources like user agent strings that can be changed.<\/p>\n\n\n\n

\"AZ_500<\/a><\/figure><\/div>\n\n\n\n
Locations<\/strong><\/h5>\n\n\n\n

Location data is given by IP geolocation data. Moreover, the administrators can choose to define locations. Further, they can choose to mark some as trusted like those for their organization’s network locations.<\/p>\n\n\n\n

Client apps<\/strong><\/h5>\n\n\n\n

Conditional Access policies by default  apply to browser apps, mobile apps, and desktop clients that support modern authentication.<\/p>\n\n\n\n

However, this assignment condition gives access to Conditional Access policies for targeting specific client applications that are not using modern authentication. The applications include Exchange ActiveSync clients, older Office applications that do not use modern authentication, and mail protocols like IMAP, MAPI, POP, and SMTP.<\/p>\n\n\n\n

Device state<\/strong><\/h5>\n\n\n\n

This control is for excluding the devices that are hybrid Azure AD joined, or marked a complaint in Intune. <\/p>\n\n\n\n

Access controls<\/strong><\/h5>\n\n\n\n

The access controls portion of the Conditional Access policy is for controlling how a policy is enforced.<\/p>\n\n\n\n

Grant<\/strong><\/h5>\n\n\n\n

Grant provides administrators meaning for the  policy enforcement where they can block or grant access.<\/p>\n\n\n\n

Block access<\/strong><\/h5>\n\n\n\n

Block access can block access under the specified assignments. The block control is powerful and should be wielded with the appropriate knowledge.<\/p>\n\n\n\n

Grant access<\/strong><\/h5>\n\n\n\n

The grant control triggers enforcement of one or more controls.<\/p>\n\n\n\n