Onboard and deploy Conditional Access App Control for any app
Applies to: Microsoft Cloud App Security
Session controls in Microsoft Cloud App Security can be configured to work with any web apps. This article describes how to onboard and deploy custom line-of-business apps, non-featured SaaS apps, and on-premise apps hosted via the Azure Active Directory (Azure AD) Application Proxy with Session controls.
For a list of apps that are featured by Cloud App Security to work out-of-the-box, see Protect apps with Microsoft Cloud App Security Conditional Access App Control.
Your organization must have the following licenses to use Conditional Access App Control:
- Azure Active Directory Premium P1 or higher
- Microsoft Cloud App Security
Apps must be configured with single sign-on in Azure AD
Apps must use SAML or Open ID Connect 2.0 protocols
To deploy any app
Follow these steps to configure any app to be controlled by Cloud App Security Conditional Access App Control.
Step 6: Update the Azure AD policy
To deploy Conditional Access App Control for Azure AD apps, you need a valid license for Azure Active Directory Premium P1 or higher as well as a Cloud App Security license.
In Azure AD, browser to Security > Conditional Access.
On the Conditional Access blade, in the toolbar at the top, click New policy.
On the New blade, in the Name textbox, enter the policy name.
Under Assignments, click Users and groups, assign the users that will be onboarding (initial sign on and verification) the app, and then click Done.
Under Assignments, click Cloud apps, assign the apps you want to control with Conditional Access App Control, and then click Done.
Under Access controls, click Session, select Use Conditional Access App Control and choose a built-in policies (Monitor only or Block downloads) or Use custom policy to set an advanced policy in Cloud App Security, and then click Select.
Optional: Add conditions and grant controls as required.
Set Enable policy to On and then click Create.
In Cloud App Security, in the menu bar, click the settings cog and select Settings.
Under Conditional Access App Control, select App onboarding/maintenance.
Enter the user principal name or email for the users that will be onboarding the app, and then click Save.
Go to the app that you are deploying. The page you see depends on whether the app is recognized. Do one of the following:
|Not recognized||You will see an app not recognized page prompting you to configure your app.||1. Add the app to Conditional Access App Control.
2. Add the domains for the app, and then return to the app and refresh the page.
3. Install the certificates for the app.
|Recognized||You will see an onboarding page prompting you to continue the app configuration process.||- Install the certificates for the app.
Note: Make sure the app is configured with all domains required for the app to function correctly. To configure additional domains, proceed to Add the domains for the app, and then return to the app page.
In the menu bar, click the settings cog , and then select Conditional Access App Control.
Click View new apps.
In the screen that opens, you can see a list of new apps. For each app you are onboarding, click on the + sign, and then click Add.
If an app does not appear in the Cloud App Security app catalog, it will appear in the dialog under unidentified apps along with the login URL. When you click the + sign for these apps, you can onboard the application as a custom app.
Associating the correct domains to an app allows Cloud App Security to enforce policies and audit activities.
For example, if you have configured a policy that blocks downloading files for an associated domain, file downloads by the app from that domain will be blocked. However, file downloads by the app from domains not associated with the app will not be blocked and the action will not be audited in the activity log.
Cloud App Security still adds a suffix to domains not associated with the app to ensure a seamless user experience.
- From within the app, on the Cloud App Security admin toolbar, click Discovered domains.
The admin toolbar is only visible to users with permissions to onboard or maintenance apps.
- In the Discovered domains panel, make a note of domain names or export the list as a .csv file.
The panel displays a list of discovered domains that are not associated in the app. The domain names are fully qualified.
- Go to Cloud App Security, in the menu bar, click the settings cog and select Conditional Access App Control.
- In the list of apps, on the row in which the app you are deploying appears, choose the three dots at the end of the row, and then under APP DETAILS, choose Edit.
To view the list of domains configured in the app, click View app domains.
- In User-defined domains, enter all the domains you want to associate with this app, and then click Save.
You can use the * wildcard character as a placeholder for any character. When adding domains, decide whether you want to add specific domains (
sub2.contoso.com) or multiple domains (
Repeat the following steps to install the Current CA and Next CA self-signed root certificates.
- Select the certificate.
- Click Open, and when prompted click Open again.
- Click Install certificate.
- Choose either Current User or Local Machine.
- Select Place all certificates in the following store and then click Browse.
- Select Trusted Root Certificate Authorities and then click OK.
- Click Finish.
For the certificates to be recognized, once you have installed the certificate, you must restart the browser and go to the same page.
- Verify that the sign in flow works correctly.
- Once you are in the app, perform the following checks:
- Visit all pages within the app that are part of a users’ work process and verify that the pages render correctly.
- Verify that the behavior and functionality of the app is not adversely affected by performing common actions such as downloading and uploading files.
- Review the list of domains associated with the app. For more information, see Add the domains for the app.
Once you are ready to enable the app for use in your organization's production environment, do the following steps.
- In Cloud App Security, click the settings cog , and then select Conditional Access App Control.
- In the list of apps, on the row in which the app you are deploying appears, choose the three dots at the end of the row, and then choose Edit app.
- Select Use with Conditional Access App Control and then click Save.
- In Azure AD, under Security, click Conditional Access.
- Update the policy you created earlier to include the relevant users, groups, and controls you require.
- Under Session > Use Conditional Access App Control, if you selected Use Custom Policy, go to Cloud App Security and create a corresponding session policy. For more information, see Session policies.
If you run into any problems, we're here to help. To get assistance or support for your product issue, please open a support ticket.