3

I'm working with a customer to try and allow only users of their domain to login.

The problem we are having is students are logging in with their home accounts when at school.

I know how to do this with Google Apps (as per here: https://support.google.com/a/answer/1668854?hl=en ), but after hours of searching, I can't find another simple way to do it for Office 365.

Any help or pointers appreciated!

5
  • have you seen this technet article? technet.microsoft.com/en-us/library/hh526961(v=ws.10).aspx
    – VF_
    Apr 20, 2015 at 8:24
  • I have seen that one, thanks. It is talking about limiting access to the domain. In this instance we are happy for them to login from anywhere, it is just we don't want them to login with their consumer accounts when at school, only the domain accounts.
    – Sillyfrog
    Apr 20, 2015 at 11:52
  • Login where? the office 365 portal? if your client has a subscription on that, only accounts created by the admin will be able to login, I don't get the difference between "consumer" and domain account, could you throw down an example on what you want to accomplish? perhaps a little bit more explaining would help. Apr 20, 2015 at 19:24
  • @Noor he's stating that the students have both personal O365 and domain O365 accounts I believe. In which case I can't think of anyway to prevent such a thing. Have you contacted O365 support Trent?
    – TheCleaner
    Apr 21, 2015 at 1:49
  • Sorry for the delay, @TheCleaner, you are correct, that is the issue. I have not personally tried them, but the customer has (as they are a school they have limited included support, so we are not holding too much faith in that).
    – Sillyfrog
    Apr 21, 2015 at 8:42

2 Answers 2

0

The problem you'll run into is that it is the same portal. You can try going this route https://technet.microsoft.com/en-us/library/hh526961(v=ws.10).aspx using ADFS policies but even then I don't think you'd be successful at limiting such a login.

O365 has tried to blur the lines on purpose between Corporate/Organization portals and the Consumer portal.

Unfortunately, my only answer I can even muster here is that it is a training/policy issue unless you deploy SSO or similar in the environment. The only other alternative would be to create a company branded O365 sign in portal https://technet.microsoft.com/en-us/library/dn532270.aspx that would at least attempt to clarify which account they should be signing in with.

4
  • I was hoping they would have something like Google where you can put in a custom HTTP header to restrict to the domain. We'll try again with MS directly (using a different channel), and see if we can get anything from them. I'm surprised more people have not requested this feature as I couldn't find any mention of it on the Microsoft site.
    – Sillyfrog
    Apr 22, 2015 at 21:45
  • I'd be curious @TrentDavis so let me know what you find out
    – TheCleaner
    Apr 23, 2015 at 13:30
  • @TrentDavis please update here how it sent with Microsoft support. Four years later, I hope this is solved.
    – chutz
    Apr 4, 2019 at 12:08
  • @chutz Unfortunately I'm no longer involved with that project, but I do know even after a couple of months it was still not sorted. Looking around a bit, it appears it's still an on going issue (eg: office365.uservoice.com/forums/273493-office-365-admin/… ) :(
    – Sillyfrog
    Apr 6, 2019 at 0:33
0

First off, I apologize for resurrecting such an old question. However, according to Microsoft, this is now possible with a feature inside of Azure AD called tenant restrictions. Here is an excerpt from the Microsoft Doc, linked below:

Large organizations that emphasize security want to move to cloud services like Microsoft 365, but need to know that their users only can access approved resources. Traditionally, companies restrict domain names or IP addresses when they want to manage access. This approach fails in a world where software as a service (or SaaS) apps are hosted in a public cloud, running on shared domain names like outlook.office.com and login.microsoftonline.com. Blocking these addresses would keep users from accessing Outlook on the web entirely, instead of merely restricting them to approved identities and resources.

The Azure Active Directory (Azure AD) solution to this challenge is a feature called tenant restrictions. With tenant restrictions, organizations can control access to SaaS cloud applications, based on the Azure AD tenant the applications use for single sign-on. For example, you may want to allow access to your organization's Microsoft 365 applications, while preventing access to other organizations' instances of these same applications.

With tenant restrictions, organizations can specify the list of tenants that their users are permitted to access. Azure AD then only grants access to these permitted tenants.

I started doing research on this subject today as I was facing the exact same quandary. A client requested this specific feature be enabled on his Azure AD and I was not sure if it was possible. Thankfully Microsoft finally (6+ years after the original question above was stated) has a solution documented for this issue:

Use tenant restrictions to manage access to SaaS cloud applications

I'm planning on implementing this solution over the next few days and I will report back in the comments to this answer if it is indeed exactly what I (and the original question) was looking for.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .