Edit

Deploy Conditional Access App Control for custom apps using Azure Active Directory

  • Article
  • 8 minutes to read

Note

Microsoft Defender for Cloud Apps (previously known as Microsoft Cloud App Security) is now part of Microsoft 365 Defender. The Microsoft 365 Defender portal allows security admins to perform their security tasks in one location. This will simplify workflows, and add the functionality of the other Microsoft 365 Defender services. Microsoft 365 Defender will be the home for monitoring and managing security across your Microsoft identities, data, devices, apps, and infrastructure. For more information about these changes, see Microsoft Defender for Cloud Apps in Microsoft 365 Defender.

Session controls in Microsoft Defender for Cloud Apps can be configured to work with any web apps. This article describes how to onboard and deploy custom line-of-business apps, non-featured SaaS apps, and on-premises apps hosted via the Azure Active Directory (Azure AD) Application Proxy with session controls. It provides steps to create an Azure AD Conditional Access policy that routes app sessions to Defender for Cloud Apps. For other IdP solutions, see Deploy Conditional Access App Control for custom apps with non-Microsoft IdP.

For a list of apps that are featured by Defender for Cloud Apps to work out-of-the-box, see Protect apps with Defender for Cloud Apps Conditional Access App Control.

Prerequisites

Before starting the onboarding process, you must do the following:

Add admins to the app onboarding/maintenance list

  1. In the menu bar of Defender for Cloud Apps, select the settings cog settings icon 4. and select Settings.

  2. Under Conditional Access App Control, select App onboarding/maintenance.

  3. Enter the user principal name or email for the users that will be onboarding the app, and then select Save.

    Screenshot of settings for App onboarding and maintenance.

Check for necessary licenses

  • Your organization must have the following licenses to use Conditional Access App Control:

  • Apps must be configured with single sign-on

  • Apps must use one of the following authentication protocols:

    IdP Protocols
    Azure AD SAML 2.0 or OpenID Connect

To deploy any app

To onboard an application to be controlled by Defender for Cloud Apps Conditional Access Control, you will need to:

Follow the steps below to configure any app to be controlled by Defender for Cloud Apps Conditional Access App Control.

Note

To deploy Conditional Access App Control for Azure AD apps, you need a valid license for Azure Active Directory Premium P1 or higher as well as a Defender for Cloud Apps license.

Configure Azure AD to work with Defender for Cloud Apps

Note

When configuring an application with SSO in Azure AD, or other identity providers, one field that may be listed as optional is the sign-on URL setting. Note that this field may be required for Conditional Access App Control to work.

  1. In Azure AD, browse to Security > Conditional Access.

  2. On the Conditional Access pane, in the toolbar at the top, select New policy -> Create new policy.

  3. On the New pane, in the Name textbox, enter the policy name.

  4. Under Assignments, select Users or workload identities, assign the users that will be onboarding (initial sign-on and verification) the app, and then select Done.

  5. Under Assignments, select Cloud apps or actions, assign the apps you want to control with Conditional Access App Control, and then select Done.

  6. Under Access controls, select Session, select Use Conditional Access App Control, and choose a built-in policy (Monitor only or Block downloads) or Use custom policy to set an advanced policy in Defender for Cloud Apps, and then click Select.

    Azure AD conditional access.

  7. Optionally, add conditions and grant controls as required.

  8. Set Enable policy to On and then select Create.

Applications in the app catalog are automatically populated into the table under Connected Apps. Sign out of the application if you have an active session and sign in again to allow for the app to be discovered. Check that the app you want to deploy is recognized by navigating there.

  1. In the menu bar of Defender for Cloud Apps, select the settings cog settings icon 1., and select the Conditional Access App Control tab to access a table of applications that can be configured with access and session policies.

    Onboard with session control.

    Conditional access app control apps.

  2. Select the App: Select apps… dropdown menu to filter and search for the app you want to deploy.

    Select App: Select apps to search for the app.

  3. If you don't see the app there, you'll have to manually add it.

How to manually add an unidentified app

  1. In the banner, select View new apps.

    Conditional access app control view new apps.

  2. In the list of new apps, for each app that you're onboarding, select the + sign, and then select Add.

    Note

    If an app does not appear in the Defender for Cloud Apps app catalog, it will appear in the dialog under unidentified apps along with the login URL. When you click the + sign for these apps, you can onboard the application as a custom app.

    Conditional access app control discovered Azure AD apps.

Associating the correct domains to an app allows Defender for Cloud Apps to enforce policies and audit activities.

For example, if you've configured a policy that blocks downloading files for an associated domain, file downloads by the app from that domain will be blocked. However, file downloads by the app from domains not associated with the app won't be blocked and the action won't be audited in the activity log.

Note

Defender for Cloud Apps still adds a suffix to domains not associated with the app to ensure a seamless user experience.

  1. From within the app, on the Defender for Cloud Apps admin toolbar, select Discovered domains.

    Select Discovered domains.

    Note

    The admin toolbar is only visible to users with permissions to onboard or maintenance apps.

  2. In the Discovered domains panel, make a note of domain names or export the list as a .csv file.

    Note

    The panel displays a list of discovered domains that are not associated in the app. The domain names are fully qualified.

  3. Go to Defender for Cloud Apps, in the menu bar, select the settings cog settings icon 2. and select Conditional Access App Control.

  4. In the list of apps, on the row in which the app you're deploying appears, choose the three dots at the end of the row, and then under APP DETAILS, choose Edit.

    Edit app details.

    Tip

    To view the list of domains configured in the app, select View app domains.

    • User-defined domains: Domains associated with the application. Navigate to the application and you can use the Admin tool bar to identify the domains associated with the application and determine if any of them are missing. Note that a missing domain can cause the protected application to not render correctly.

    • Treat access token as login requests: Some applications use access tokens and code requests as app logins. This gives the ability to treat access token and code requests as logins when onboarding apps to access and session controls for the application to render correctly. When onboarding the application, always make sure this is ticked.

    • Use app with session control: To allow this app to be used or not used with session controls. When onboarding the application always make sure this is ticked.

    • Perform a second logon: If the application uses a nonce, a second logon is needed to account for nonce handling. The nonce or second logon is used by applications to make sure that the login token that the IdP creates for the user can only be used once, and not stolen and reused by someone else. The nonce is checked by the Service Provider to match what it was expecting, and not something it has recently used already, which could indicate a replay attack. When this is chosen, we ensure that a second login is being triggered from a suffixed session, which ensures a successful login. For better performance, this should be enabled.

      Perform a second login.

  5. In User-defined domains, enter all the domains you want to associate with this app, and then select Save.

    Note

    You can use the * wildcard character as a placeholder for any character. When adding domains, decide whether you want to add specific domains (sub1.contoso.com,sub2.contoso.com) or multiple domains (*.contoso.com).

  6. Repeat the following steps to install the Current CA and Next CA self-signed root certificates.

    1. Select the certificate.
    2. Select Open, and when prompted select Open again.
    3. Select Install certificate.
    4. Choose either Current User or Local Machine.
    5. Select Place all certificates in the following store and then select Browse.
    6. Select Trusted Root Certificate Authorities and then select OK.
    7. Select Finish.

    Note

    For the certificates to be recognized, once you have installed the certificate, you must restart the browser and go to the same page.<!-- You'll see a check-mark by the certificates links confirmation they are installed.--

  7. Select Continue.

  8. Check that the application is available in the table.

    Onboard with session control.

To verify that the application is being proxied, first perform either a hard sign-out of browsers associated with the application or open a new browser with incognito mode.

Open the application and perform the following checks:

  • Check that the URL contains the .mcas suffix
  • Visit all pages within the app that are part of a user's work process and verify that the pages render correctly.
  • Verify that the behavior and functionality of the app isn't adversely affected by performing common actions such as downloading and uploading files.
  • Review the list of domains associated with the app.

If you encounter errors or issues, use the admin toolbar to gather resources such as .har files and recorded sessions for filing a support ticket.

Once you're ready to enable the app for use in your organization's production environment, do the following steps.

  1. In Defender for Cloud Apps, select the settings cog settings icon 3., and then select Conditional Access App Control.
  2. In the list of apps, on the row in which the app you're deploying appears, choose the three dots at the end of the row, and then choose Edit app.
  3. Select Use the app with session controls and then select Save.
  4. In Azure AD, under Security, select Conditional Access.
  5. Update the policy you created earlier to include the relevant users, groups, and controls you require.
  6. Under Session > Use Conditional Access App Control, if you selected Use Custom Policy, go to Defender for Cloud Apps and create a corresponding session policy. For more information, see Session policies.

Next steps

PREVIOUS: Deploy Conditional Access App Control for catalog apps

NEXT: How to create a session policy

See also

Introduction to Conditional Access App Control

Troubleshooting access and session controls

If you run into any problems, we're here to help. To get assistance or support for your product issue, please open a support ticket.