I started this blog post series with “How to get started with Conditional Access” and will continue with some use cases. This use cases can be combined or be implemented stand alone – it all depends what you are your organisation want to accomplish.
In this use case we just add a extra layer of security on top on Office 365 web access – that can also be other applications like sharepoint, Service Now and other apps that provided a web access through Azure Active directory. This is a typical request I get from customers – and it is a easy way to get started with Conditional Access.
The layout is to get a MFA request when:
- Accessing Exchange Online
- From a webbrowser
- Outside of the corporate network
- On any devices
Note: MFA for Office 365 requires modern authentication enabled
Start the Azure Active Directory admin center
- Click Azure Active Directory
- Click Conditional Access
- Click New policy
- Enter a name that makes sense to you : “Ca – Require MFA for EXO”
- Select Assignments
- Select All users
It is recommended to do this at a test group first, and go into production in faces
- Select Cloud apps
- Select Selected apps
- Select Office 365 Exchange Online
- Select Conditions
- Select Device Platform
- Click Configure – Yes
- Select All platforms (Including unsupported)
If you for some reason what different rules on different OS then here is the place to select it
- Select Conditions
- Select Locations
- Select Configure – Yes
- Select Any location
If you only want the MFA to applies from outside your corporate network
- Select Locations
- Select Exclude
- Click Selected locations
- Click Select
- Select MFA Trusted IPs
- Select Conditions
- Select Client Apps
- Select Configure – Yes
- Select only browser
If you are not deselection “Mobile apps and desktop client” the MFA will have effect on Outlook and other mail apps as well
- Select Access controls
- Select “Require multi-factor authentication”
Now the Conditional Access rule are created and will first take effect when you sets the Enable policy to On
Now for the end user experience:
In this case my user Jane Doe start the Exchange Online web access at https://outlook.office.com/owa/
She is prompted with the normal Sign in page
Enters the password
Then the MFA kicks in and she is prompted for the text code to the authentication phone
Then she has access as normally.
It is recommended to get the end user to MFA enroll before enabling the Conditional Access policy so that you can ensure that they have access after the Conditional Access policy enforcement. When the policy is enabled the first time the end user logins in to Exchange Online webaccess they are prompted to enroll into AzureMFA – but your end users can do the in advance on this site https://aka.ms/mfasetup
Read more:
Deploy cloud-based Azure Multi-Factor Authentication
If you not already have enabled modern auth in office 365 then check this out :
Enable or disable modern authentication in Exchange Online
Cloud First 