You would see several Office 365 related applications listed there, currently only the Office 365 Exchange Online, Office 365 SharePoint Online, Dynamics CRM and Yammer one support conditional access. The feature can be enabled on per-directory and per-app basis: login to your Azure portal, select the Office 365 directory you want to work with, then click on the Applications tab. What’s new is the fact that it now works for Office 365 workloads as well. Let’s take a quick look.įirst, just to clarify that conditional access in Azure AD isn’t something new, it has been around for a while now. Now, with the introduction of MFA conditional access for Office 365 applications, things have changed and in some regards the service is even superior to AD FS. While the Azure MFA service has long offered the whitelisting feature, which allows us to control access based on the location of the client, it lacked the granularity AD FS claims rules offered. Īt the time the article was published, using federated scenario and configuring the AD FS claims rules was the only option available to configure such conditional access scenarios for Office 365 apps. registered, managed or unknown device), group membership and any other AD attribute for the user, and to some extent the application used.

The list of conditions to use included the location of the client, device status (i.e.

the ones that support Modern authentication). More specifically, I examined how AD FS can be configured to use any additional 2FA provider and combine this with the claims rule engine to configure the authentication rules for any ADAL-enabled client (i.e. Few months back I wrote an article about utilizing claims rules to enable scenarios such as “force additional authentication for requests coming outside of the corporate network”.

Mfa conditional access