Block all but one app in conditional access (Azure AD)

Question

Block all but one app in conditional access (Azure AD)

Ezeq 1

Hi!
I'm trying to create a conditional access rule using the logic "Block all but X", the issue is when I try to apply this in one single Conditional Access Policy.

I created a Conditional Access Policy with the "Grant" being "Block access" to be applied to "All cloud apps" excluding one specific app, also created an "Allow Register security information" for this users .

The result is that the new user are not able to register the required security details and I can not exclude the "Microsoft App Access Panel"(1) nor the "O365 Suite UX" (2) because they are "UnSupportedFirstyPartyApplication"(3)

So does anyone found a way to apply restrictions following the logic of "block first, allow case by case" or do I / (we the users) have to live with this the "Allow all, block selected" way, or yet, am I completely out of sync with the philosophy of the conditional access function?

tests done in (1) early November and (2) today
(3) message obtained while using powershell to add the exemption condition

Jean Chavez 1 Reputation point

2021-02-19T23:56:51.527+00:00

You can use Conditional Access Session Control and cloud app security to achieve that. Block only your privileged app with Conditional Acces, then using Conditional Access target all apps and use Session Control cloud app security to allow only the apps you need including MyAPPs for MFA registration.

1 answer

Your answer

Jean Chavez 1 Reputation point

2021-02-19T23:56:51.527+00:00

You can use Conditional Access Session Control and cloud app security to achieve that. Block only your privileged app with Conditional Acces, then using Conditional Access target all apps and use Session Control cloud app security to allow only the apps you need including MyAPPs for MFA registration.

Answer 1

Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,526 Moderator

Hello @Ezeq , provided the application is not a 1st party application (the ones belonging to the tenant f8cdef31-a31e-4b4a-93e4-5f571e91255a) you can apply the "block all by allow some" logic. For a list of Microsoft built in application supported by Conditional Access take a look here. You can also use the Office 365 application (preview) which includes a list of key applications which can be included or excluded like a whole or on a per application basis.

Please let me know if you need more help. If the answer was helpful to you, please accept it and, optionally, provide feedback so that other members in the community can benefit from it.

Ezeq 1 Reputation point

2020-12-14T15:10:08.747+00:00

Thanks for your reply, but I think it doesn't apply to the use case.
Let's say that we have a Wifi network with WPA Enterprise and user login with Azure AD credentials. Add that we have an external tech team that requires access to that network, so they need to change the password, set the security info (like recovery email and phone for MFA).

I need to have an evidence that this user will never (ever) be able to access any other resource [block all option] but it has to be able to add and change the security info. The "block all" will block this last condition (edit the sec. info) and won't allow to add this 1st party application to the exemption list.

BR
Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,526 Reputation points Moderator

2020-12-14T21:58:18.31+00:00

That's correct. Currently this limitation you won't be able to block all but 1st party applications.

Share via

Block all but one app in conditional access (Azure AD)

1 answer

Your answer