Azure AD Conditional Access

[ajg]

Hi, I was just wondering if anyone on here uses Azure AD Conditional Access? We are in the process of looking at OneDrive for certain areas but ideally I would like to be able to allow staff to edit Office documents online via OneDrive and Office Online but not allow them to download the files/folders to their personal devices.

 

I have signed up for a trial of the Microsoft Cloud App Security Licence and have it all working for a test user but just wondered if I have missed a trick and there is another way of doing this as it looks like it will cost around £1400 a year to cover 145 staff for the standalone Microsoft Cloud App Security Licence. I initially thought Azure Premium P1 licence would allow it (which we already have) but it doesn't activate the ability to prevent downloads.

 

Any advice appreciated.

[DrCheese]

Yup - I use this. I have conditional access via Azure P1 set to block staff using "Fat" desktop clients on non school-owned computers. They can access Onedrive/Sharepoint via the browser but can't download files.

 

If they want to download files/use the fat desktop apps they have to use our remote access system as before - You don't need Cloud app security for this, I only have P1.

[ajg]

Right OK well that sounds promising, perhaps I'm missing something then. I'll take another look, might get back to you with some screenshots of my setup if I'm still struggling. Thanks.

[DrCheese]

This is what you need

 

https://docs.microsoft.com/en-us/sharepoint/control-access-from-unmanaged-devices

 

You can do it on all of your sharepoint/onedrive content, or on specific libaries /users.

[ajg]

Hi, that's sorted it. I had the policy correct but didn't realise I needed to set the sharepoint access control settings to limited as well. It will be interesting to see if this breaks anything else. Thanks again.

[DrCheese]

You're welcome - It's a fine balance between giving staff access to what they need, but keeping your data safe.

 

My logic is that if we ran Google Docs, the web version would be the only version we'd have anyway.

If staff are desperate to use the "Fat" desktop apps remotely they can do so via our Remote Access system, or on a school owned laptop joined to Azure AD.

 

The idea of just allowing full access on home personal computers scared me, as I know most home computers are shared between members of the same household - i.e A Colleague activated his son's home copy of Office using his wife's schools details - Full access to their sharepoint shares. Yuck!

 

Likewise with allowing the sync agent - It's a data breach nightmare!

[ajg]

My thoughts exactly. Sounds like we are very similar to yourselves, remote access is currently the only way staff can access their files. Out of curiosity have you replaced your network drives with OneDrive or do you use it in tandem so staff upload what they want to onedrive?

[DrCheese]

I haven't yet no - I did toy with mass migrating staff automatically myself but a lot of advise online recommends you let staff do it themselves.

 

https://www.itpromentor.com/understanding-file-server-migrations/

 

I think my plan will be "It's here woooo - Get migrating!" Then after 4/5 months make on prem shares read only & force migrate anyone left. Students I'll do automatically.

[5tu]

Can I ask how you’re licensing this? Do you have AD P1 licences and EM+S licences for all users?

[chaplic]

P1 license is all you need.

 

To prevent downloads, use the 'use app enforce restrictions' under Access Control, Session for a policy targetting your user and onedrive/sharepoint. I am not sure but this may require a setting in sharepoint too. It may require the Policies\Access Control\ Unmanaged Devices to be set to Allow Limited, Web Only in sharepoint admin too.

 

I would exclude smartphones from the policy and set an intune managed app policy (phone does NOT need to be enrolled) to do things like require pin and block copy paste etc. Then people can use sharepoint app or teams.

[5tu]

Thanks for this. Do all users need the P1 license?

[chaplic]

Thanks for this. Do all users need the P1 license?

 

 

Every user that is in scope of it needs a license. you may notice that it may apply to unlicensed people, but I'm not sure that's a smart thing to rely on...

[DrCheese]

I would exclude smartphones from the policy and set an intune managed app policy (phone does NOT need to be enrolled) to do things like require pin and block copy paste etc. Then people can use sharepoint app or teams.

 

iOS nope, you just set an MAM policy for Microsoft apps & they work out the box, without requiring you to either enroll to Azure AD (Azure AD join) or register to Azure AD (Azure AD registered)

 

Android however makes you install "Company portal" & register to azure (Azure AD registered) before the MAM policies take affect. Very different than full on enrolling in MDM, but still an extra app for staff to put on their devices.