Azure AD Conditional Access to block sharepoint and allow teams and exchange

Question

Hi everyone,

Im trying to create a new policy through azures conditional access policies and have a bit of issues with mobile devices. What I need to do is block all sharepoint connections for all users except a group of managers or if they are on our network. I need everyone to still have access to teams and emails (I know sharepoint block will limit functionality).

What I have tried -

-Block all users. Exclude manager group.

-Selected Sharepoint Online. Excluded teams and exchange.

-Allowed all device platforms. For location I used United states for testing (to block access in US). Excluded the IP address of our HQ. Configured for all client apps.

-Block access

-Use app enforced restrictions.

With those settings manager group can access everything without any issues. Employees on the network can connect and use all the services. But when they are not on our network it is also blocking access to everything, including teams and exchange.

Answer 1

Hello @Keith D ,

Thank you for reaching out. I would like to share following details:

• Microsoft Teams is a bundle of services which is depended on various different services either on late bound or early bound access:

• Early-bound policy enforcement means a user must satisfy the dependent service policy before accessing the calling app. For example, a user must satisfy SharePoint policy before signing into MS Teams.
• Late-bound policy enforcement occurs after the user signs into the calling app. Enforcement is deferred to when calling app requests, a token for the downstream service. Examples include MS Teams accessing Planner and Office.com accessing SharePoint.
• More details available on following documentation: https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/service-dependencies

Since your policy is blocking SharePoint, users are also getting blocked when access Teams. Since Teams has an early bound dependency on SharePoint, however it is blocked in the conditional access policy you have created.

As a best practice, you should set common policies across related apps and services whenever possible. Having a consistent security posture provides you with the best user experience. For example, setting a common policy across Exchange Online, SharePoint Online, Microsoft Teams, and Skype for business significantly reduces unexpected prompts that may arise from different policies being applied to downstream services.

I hope this helps and hence would request you to please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Mistake message