Share via

Conditional Access Policy to restrict normal users from using Azure Active Directory PowerShell

Aleksandar Pavlov 1 Reputation point
2020-10-05T14:57:42.413+00:00

Hello all,

I'm looking for a solution(conditional access policy) or something else that will restrict normal users from accessing azure active directory power shell and execute msol (get-msolgroup) or azure ad cmdlet's.

If someone has a solution please share.

I was looking in internet but could not find anything.

Thank you.

Regards Aleks

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
21,308 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andy David - MVP 147.5K Reputation points MVP
    2020-10-05T15:08:33.383+00:00

    Have you seen this?

    https://o365blog.com/post/limit-user-access/

    Related: Also, you can use a CA for blocking access to the mgmt tools except Azure AD PS:
    https://learn.microsoft.com/en-us/azure/role-based-access-control/conditional-access-azure-management

    2 people found this answer helpful.
    0 comments
  2. Aleksandar Pavlov 1 Reputation point
    2020-10-06T09:43:59.63+00:00

    Hello AndyDavid,

    thank you for your reply.
    I tried the commands but I forgot to mention that my tenant is in China, operated by 21 Vianet.
    When I tried Get-AADIntAccessTokenForMSGraph -SaveToCache
    I got an error, the admin account is not recognized.
    30352-capture.png

    I treid also Get-AADIntAccessTokenForMSGraph -SaveToCache -Domain tenant.partner.onmschina.cn but I got a request for KerberosTicket and I don't know how to get it. Do you have any suggestions?

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.