New-AzureADMSConditionalAccessPolicy
Crea una nueva directiva de acceso condicional en Azure Active Directory.
Syntax
New-AzureADMSConditionalAccessPolicy
[-Id <String>]
[-DisplayName <String>]
[-State <String>]
[-Conditions <ConditionalAccessConditionSet>]
[-GrantControls <ConditionalAccessGrantControls>]
[-SessionControls <ConditionalAccessSessionControls>]
[<CommonParameters>]
Description
Este cmdlet permite a un administrador crear una nueva directiva de acceso condicional en Azure Active Directory. Las directivas de acceso condicional son reglas personalizadas que definen un escenario de acceso.
Ejemplos
Ejemplo 1: Crea una nueva directiva de acceso condicional en Azure AD que requiere MFA para acceder a Exchange Online
PS C:\> $conditions = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessConditionSet
PS C:\> $conditions.Applications = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessApplicationCondition
PS C:\> $conditions.Applications.IncludeApplications = "00000002-0000-0ff1-ce00-000000000000"
PS C:\> $conditions.Users = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessUserCondition
PS C:\> $conditions.Users.IncludeUsers = "all"
PS C:\> $controls = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessGrantControls
PS C:\> $controls._Operator = "OR"
PS C:\> $controls.BuiltInControls = "mfa"
PS C:\> New-AzureADMSConditionalAccessPolicy -DisplayName "MFA policy" -State "Enabled" -Conditions $conditions -GrantControls $controls
Id : 6b5e999b-0ba8-4186-a106-e0296c1c4358
DisplayName : MFA policy
CreatedDateTime : 2019-09-26T23:12:16.0792706Z
ModifiedDateTime : 2019-09-27T00:12:12.5986473Z
State : Enabled
Este comando crea una nueva directiva de acceso condicional en Azure AD que requiere MFA para acceder a Exchange Online.
Ejemplo 2: Crea una nueva directiva de acceso condicional en Azure AD que bloquea el acceso a Exchange Online desde regiones que no son de confianza
PS C:\> $conditions = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessConditionSet
PS C:\> $conditions.Applications = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessApplicationCondition
PS C:\> $conditions.Applications.IncludeApplications = "00000002-0000-0ff1-ce00-000000000000"
PS C:\> $conditions.Users = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessUserCondition
PS C:\> $conditions.Users.IncludeUsers = "all"
PS C:\> $conditions.Locations = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessLocationCondition
PS C:\> $conditions.Locations.IncludeLocations = "198ad66e-87b3-4157-85a3-8a7b51794ee9"
PS C:\> $controls = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessGrantControls
PS C:\> $controls._Operator = "OR"
PS C:\> $controls.BuiltInControls = "block"
PS C:\> New-AzureADMSConditionalAccessPolicy -DisplayName "MFA policy" -State "Enabled" -Conditions $conditions -GrantControls $controls
Id : 6b5e999b-0ba8-4186-a106-e0296c1c4358
DisplayName : MFA policy
CreatedDateTime : 2019-09-26T23:12:16.0792706Z
ModifiedDateTime : 2019-09-27T00:12:12.5986473Z
State : Enabled
Ejemplo 3: Crea una nueva directiva de acceso condicional en Azure AD que bloquea el acceso a Exchange Online desde dispositivos no compatibles
PS C:\> $conditions = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessConditionSet
PS C:\> $conditions.Applications = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessApplicationCondition
PS C:\> $conditions.Applications.IncludeApplications = "00000002-0000-0ff1-ce00-000000000000"
PS C:\> $conditions.Users = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessUserCondition
PS C:\> $conditions.Users.IncludeUsers = "all"
PS C:\> $conditions.Devices = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessDevicesCondition
PS C:\> $conditions.Devices.DeviceFilter = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessFilter
PS C:\> $conditions.Devices.DeviceFilter.Mode = "exclude"
PS C:\> $conditions.Devices.DeviceFilter.Rule = "device.isCompliant -eq True"
PS C:\> $controls = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessGrantControls
PS C:\> $controls._Operator = "OR"
PS C:\> $controls.BuiltInControls = "block"
PS C:\> New-AzureADMSConditionalAccessPolicy -DisplayName "Block Non-compliant device policy" -State "Enabled" -Conditions $conditions -GrantControls $controls
Id : c5560f6b-2931-4b40-8e94-8b9e11a507c1
DisplayName : Block Non-compliant device policy
CreatedDateTime : 2022-04-20T15:15:41.9500079Z
ModifiedDateTime :
State : enabled
Este comando crea una nueva directiva de acceso condicional en Azure AD que bloquea el acceso a Exchange Online desde regiones que no son de confianza. Muestra el uso del filtro para la condición de dispositivos .
Parámetros
-Conditions
Especifica las condiciones de la directiva de acceso condicional en Azure Active Directory.
Type: | ConditionalAccessConditionSet |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-DisplayName
Especifica el nombre para mostrar de una directiva de acceso condicional en Azure Active Directory.
Type: | String |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-GrantControls
Especifica los controles de la directiva de acceso condicional en Azure Active Directory.
Type: | ConditionalAccessGrantControls |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-Id
{{ Fill Id Description }}
Type: | String |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-SessionControls
{{ Fill SessionControls Description }}
Type: | ConditionalAccessSessionControls |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-State
Especifica el estado habilitado o deshabilitado de la directiva de acceso condicional en Azure Active Directory.
Type: | String |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
Comentarios
https://aka.ms/ContentUserFeedback.
Próximamente: A lo largo de 2024 iremos eliminando gradualmente GitHub Issues como mecanismo de comentarios sobre el contenido y lo sustituiremos por un nuevo sistema de comentarios. Para más información, vea:Enviar y ver comentarios de