Wondering if you guys could help as I'm stuck!
I have configured ADFS for authentication for our Office 365 tenant in order to provide us with the ability to prevent access to all of Office 365 based on IP address so that staff can only connect to O365 if they are in the office or on the VPN. The exception to this is ActiveSync, which I have configured an exception on.
I have the following ADFS claim rule in place which should ensure that if a request comes in via the web application proxy (ie, external connection) and ActiveSync or Autodiscover aren't the applications used and their client IP is not one of our office IPs, issue a deny:
exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-proxy"]) && NOT exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-client-application", Value == "Microsoft.Exchange.Autodiscover"]) && NOT exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-client-application", Value == "Microsoft.Exchange.ActiveSync"]) && NOT exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-forwarded-client-ip", Value =~ "ipregexhere"]) => issue(Type = "http://schemas.microsoft.com/authorization/claims/deny", Value = "true");
However, I've noticed that staff are able to connect to Outlook from outside of the network (ie at home/airports etc) without connecting to the VPN. This shouldn't be possible as ADFS has a rule in place.
Can anyone help me figure out why staff are able to connect from outside the network still? I have a feeling its related to our recent change from Office 2013 Standard MSI to Office 365 Pro Plus C2R which uses Modern Authentication but I’m banging my head against a wall!