question

CochranJoel-9319 avatar image
0 Votes"
CochranJoel-9319 asked ·

Conditional Access Question

We let SharePoint auto-create the policy "Block Access from Apps on Unmanaged Devices" which essentially does the following:

  • Users and Groups = All Users (except Global Admins)

  • Cloud apps or Actions = Office 365 SharePoint Online

  • Conditions - Client Apps = Mobile apps and desktop clients

  • Access Controls = Require either Hybrid Azure Joined or compliant

Someone attempted to sign into Outlook (for Android) on their tablet, and it was prompting them to install the Company Portal app. I thought it would only trigger if they were attempting to access OneDrive FB or SharePoint via an app? Turning it to Report-Only resolved for now as we're just in testing phase.

There is a separate cloud app for Exchange Online, so I thought the SharePoint app would only apply to SPO and ODfB. Any ideas?

office-sharepoint-onlineoffice-exchange-server-connectivityazure-ad-conditional-access
· 2
10 |1000 characters needed characters left characters exceeded
Toggle Comment visibility. Current Visibility: Visible to all users

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

CochranJoel-9319 avatar image CochranJoel-9319 ·

Thanks for the info. I'm just confused about a thing or two.

  • When we had the policy in Report-Only, it showed that it wasn't applied as the Outlook Mobile Application was "Not Matched". As soon as we turned it on, it started matching Outlook Mobile Application. Didn't really make sense to me.

  • Why is Exchange using SharePoint data? We only setup people here with Exchange and disable SharePoint Online access. Everything still works fine. In fact, if we attempt to sign them into OneDrive (after granting them that service license), it has to be setup the first time. Seems like if they didn't have access to SP then their email wouldn't work at all.

Again...I might be comparing apples and oranges here, or just be totally off the mark.



0 Votes 0 ·
ChelseaWu-MSFT avatar image ChelseaWu-MSFT CochranJoel-9319 ·

To answer your questions:

  1. According to the document: What is Conditional Access report-only mode?
    Report-only mode is used to evaluate the impact of Conditional Access policies before enabling them in their environment and is not applicable for Conditional Access policies with "User Actions" scope.
    Policies in report-only are evaluated but not enforced during sign-in, which is possibly why it matches more applications after being enabled.

  2. Exchange is not using SharePoint data, but storing data in the linked OneDrive/SharePoint account. It does not matter if you have a OneDrive account connected in Outlook, it is covered by the policy soon as the client/app calls the service.

1 Vote 1 ·

2 Answers

ChelseaWu-MSFT avatar image
0 Votes"
ChelseaWu-MSFT answered ·

Conditional Access policy is not set directly on a client (public/native) application, but is applied when a client calls a service, quoting the document here: Conditional Access: Cloud apps or actions.

The policy blocks user access whenever the client/app is calling SharePoint or OneDrive, while Outlook mobile app uses OneDrive for storage purpose. That is why Outlook mobile app is not excluded from this policy and asks for enrollment on non-compliant devices.

If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

·
10 |1000 characters needed characters left characters exceeded
Toggle Comment visibility. Current Visibility: Visible to all users

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

michalbartak avatar image
0 Votes"
michalbartak answered ·

Hello,

when you add your account to Outlook on Android, it automatically adds OneDrive for Business as well. And since the URL is basically on Sharepoint, then I assume this is what is happening?

·
10 |1000 characters needed characters left characters exceeded
Toggle Comment visibility. Current Visibility: Visible to all users

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.