Restrict Dynamics 365 Sales Application to Registered Devices

Question

Restrict Dynamics 365 Sales Application to Registered Devices

Ziggy Zulueta 495 MVP

My client wants to use Dynamics 365 Sales for their business. It however contains very sensitive data and hence they only want users to access the system inside the office. Each user will be assigned a Laptop that they cannot bring home. Given that Physical security will ensure that each laptop will only stay in the office, how do we setup security in such a way that users can only login to Dynamics Sales inside the office for those laptops they are assigned to? The users cannot login to other devices and may not be able to login outside the office. In addition, what license is needed to set this up?

JamesTran-MSFT 36,841 Reputation points Microsoft Employee

2024-02-22T18:42:46.4133333+00:00

@Ziggy Zulueta
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.
Ziggy Zulueta 495 Reputation points MVP

2024-02-23T01:01:48.56+00:00

I am more keen on having it restricted on a per device basis as the device will never leave the office. From what I read, if the person is logged in in the approved location but decides to go out and bring the said device, he/she may still be logged in till the session expires which is not what we want. Please kindly verify this. Can you tell me more about this feature? I cannot seem to know how to set this up: https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-condition-filters-for-devices?fbclid=IwAR0tPy37qw5YPCupOnxCxN3g9sW65B-wXONvm1CLAsKnunBiaIOXrfKI0Rk

1 answer

Your answer

JamesTran-MSFT 36,841 Reputation points Microsoft Employee

2024-02-22T18:42:46.4133333+00:00

@Ziggy Zulueta
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.
Ziggy Zulueta 495 Reputation points MVP

2024-02-23T01:01:48.56+00:00

I am more keen on having it restricted on a per device basis as the device will never leave the office. From what I read, if the person is logged in in the approved location but decides to go out and bring the said device, he/she may still be logged in till the session expires which is not what we want. Please kindly verify this. Can you tell me more about this feature? I cannot seem to know how to set this up: https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-condition-filters-for-devices?fbclid=IwAR0tPy37qw5YPCupOnxCxN3g9sW65B-wXONvm1CLAsKnunBiaIOXrfKI0Rk

Answer 1

Crystal-MSFT 52,996 Microsoft External Staff

@Ziggy Zulueta， Thanks for posting in Q&A. Based on my researching, Conditional access policy has a feature nemed location. You can create Office location.

https://learn.microsoft.com/en-us/entra/identity/conditional-access/location-condition

Then create conditional access policy to block any location access exclude the office location:

https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-policy-location

Hope the above information can help.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Ziggy Zulueta 495 Reputation points MVP

2024-02-23T01:01:59.3266667+00:00

I am more keen on having it restricted on a per device basis as the device will never leave the office. From what I read, if the person is logged in in the approved location but decides to go out and bring the said device, he/she may still be logged in till the session expires which is not what we want. Please kindly verify this.

Can you tell me more about this feature? I cannot seem to know how to set this up:

https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-condition-filters-for-devices?fbclid=IwAR0tPy37qw5YPCupOnxCxN3g9sW65B-wXONvm1CLAsKnunBiaIOXrfKI0Rk
Crystal-MSFT 52,996 Reputation points Microsoft External Staff

2024-02-23T03:00:12.4666667+00:00

@Ziggy Zulueta, Thanks for the reply. For the filter in conditional access. It can target or exclude specific devices according to the device attributes we configure for devices condition.

For example, if these devices name contain some specific word, we can use "displayName" to filter these devices. Or if these devices are with specific model. we can use "model" to filter these devices.

Hope the above information can help.
Ziggy Zulueta 495 Reputation points MVP

2024-02-23T05:53:46.59+00:00
@Crystal-MSFT Thanks for the reply. I would need help on testing it. I tried testing with DeviceName and DeviceID and both of them arent working for Adele Vance test user in CDX.

Please see below:

I blocked user access to all cloud aps but excluded devices that have displayName ziggy which was the name of my pc. I got this value by running "hostname" in cmd.

I blocked user access to all cloud aps but excluded devices that have displayID which was the deviceID of my pc. I got this value by running "wmic csproduct get uuid" in cmd.

In both cases, my user could not access outlook.com.

So how do we get the deviceName or deviceID to have the user access Outlook tied to a specified device?
Crystal-MSFT 52,996 Reputation points Microsoft External Staff

2024-02-23T06:09:41.29+00:00

@Ziggy Zulueta, Thanks for the reply. Please check the sign in log to find the device info and check the detailed condition access policy settings to this device. Here is a link with more details for your reference: https://learn.microsoft.com/en-us/entra/identity/conditional-access/troubleshoot-conditional-access
Ziggy Zulueta 495 Reputation points MVP

2024-02-23T06:20:32.28+00:00

Here is the result. I dont know why the Device identifier of my laptop is not available
Crystal-MSFT 52,996 Reputation points Microsoft External Staff

2024-02-23T06:49:31.5766667+00:00

@Ziggy Zulueta, For the device id, it is Microsoft Entra device ID. Please check the Microsoft Entra device id in Microsoft Entra portal or Intune portal to get the right one.
Ziggy Zulueta 495 Reputation points MVP

2024-02-23T07:26:48.12+00:00

my device ID is blank. is there something i should do ?
Crystal-MSFT 52,996 Reputation points Microsoft External Staff

2024-02-23T08:00:23.26+00:00

@Ziggy Zulueta, For the device, could you check if it already exists in Microsoft Entra?
Ziggy Zulueta 495 Reputation points MVP

2024-02-23T08:08:54.28+00:00

I was actually wondering if I should register devices - if its a need or not. There are no devices existing
Crystal-MSFT 52,996 Reputation points Microsoft External Staff

2024-02-23T08:30:19.0266667+00:00

@Ziggy Zulueta, For the device id, it is generated when the device is registered or join into Microsoft Entra. So yes, we need to register or join the device.
Ziggy Zulueta 495 Reputation points MVP

2024-02-23T11:05:44.2166667+00:00

Am I going to use the Entra Device ID or the Intune Device ID? The Entra Device ID doesnt make sense though
Crystal-MSFT 52,996 Reputation points Microsoft External Staff

2024-02-26T02:05:22.1833333+00:00

@Ziggy Zulueta, Thanks for the reply. As conditional access is a feature in Microsoft Entra, it uses the Entra Device ID. For the device ID , it looks abnormal in your environment. I suggest open case to look into the issue in the background.

https://learn.microsoft.com/en-us/entra/fundamentals/how-to-get-support
Ziggy Zulueta 495 Reputation points MVP

2024-02-26T02:09:55.0233333+00:00

Thanks. Im using a CDX Test Environment though. So opening a ticket would be tricky. Let's see how it goes. Please kindly leave this open for now
Crystal-MSFT 52,996 Reputation points Microsoft External Staff

2024-02-26T02:23:24.3366667+00:00

@Ziggy Zulueta, Thanks for reply. OK, no problem. I notice tag "Microsoft Entra ID" is added. You can wait to see if any Microsoft Entra support will reply on this.

Or you can open a new thread and add "Microsoft Entra ID" tag to see if we can get help from forum.
Ziggy Zulueta 495 Reputation points MVP

2024-02-26T03:15:35.77+00:00

After further investigation, I found that after enrolling only in device management

The device is in Intune but is not in Entra ID. Is there a step I should do for it to get displayed in Entra ID.
Ziggy Zulueta 495 Reputation points MVP

2024-02-26T03:16:49.3266667+00:00
Crystal-MSFT 52,996 Reputation points Microsoft External Staff

2024-02-26T04:35:03.0733333+00:00

@Ziggy Zulueta, You can try the enrollment method in the following link instead of the "Enroll only in device management" to enroll the device https://learn.microsoft.com/en-us/mem/intune/fundamentals/deployment-guide-enrollment-windows

Share via

Restrict Dynamics 365 Sales Application to Registered Devices

1 answer

Your answer