1

I'm testing azure conditional access to create a rule that blocks the use of office 365 cloud and client apps from outside of the office network.

I set up a new policy and it's blocking cloud access but not the desktop clients like outlook, if I go to the "What If" menu and run it with the options that I'm testing it says that it should block the access to outlook.

I know it would be easier with ADFS but I know it can be done with conditional access.

Is there a way to troubleshoot or some kind of logs where I can see why it's not blocking the access for desktops apps?

Thanks

Improve this question

2 Answers 2

Reset to default
2

If you want to block the desktop clients, you can click New policy - select the users and groups that you want to control access - select cloud apps - select conditions - client apps- select Mobile apps and desktop clients, or Modem authentication clients, or Exchange activesync clients or Other clients.

enter image description here

Then from the access controls, select Block access to be enforced.

enter image description here

Go back to check if the policy is enabled. As for what if tool, here is a explanation.

It allows you to understand the impact of your conditional access policies on your environment. Instead of test driving your policies by performing multiple sign-ins manually, this tool enables you to evaluate a simulated sign-in of a user. The simulation estimates the impact this sign-in has on your policies and generates a simulation report.

For more information, refer to Azure Active Directory conditional access what if tool - preview and Conditions in Azure Active Directory conditional access

Improve this answer
2
  • @nancy-xiong-msft that is pretty much what I have but with another condition that only allows the connection to cloud/desktop apps from an IP range. It's blocking the cloud apps just fine, it's just not blocking the Outlook client(2016)
    – Plaguna
    Jun 6, 2018 at 10:09
  • Hi @Plaguna, may i know more about the way you test the outlook client access. You should verify the policy by locating in the conditional IP range. The policy should be taken effect when all conditions are met.
    – Nancy
    Jun 6, 2018 at 15:36
0

Managed to find the answer, in my case OAuth2ClientProfileEnabled was set to false in exchange online and I need to set it to true.

To check if it's true or false run:

Get-OrganizationConfig | findstr OAuth2ClientProfileEnabled

And to set it to true:

Set-OrganizationConfig -OAuth2ClientProfileEnabled $true

Once that's done the policies started taking effect.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .