New-AzureADMSConditionalAccessPolicy

Modulo:

AzureADPreview

Crea un nuovo criterio di accesso condizionale in Azure Active Directory.

Sintassi

New-AzureADMSConditionalAccessPolicy
   [-Id <String>]
   [-DisplayName <String>]
   [-State <String>]
   [-Conditions <ConditionalAccessConditionSet>]
   [-GrantControls <ConditionalAccessGrantControls>]
   [-SessionControls <ConditionalAccessSessionControls>]
   [<CommonParameters>]

Descrizione

Questo cmdlet consente a un amministratore di creare nuovi criteri di accesso condizionale in Azure Active Directory. I criteri di accesso condizionale sono regole personalizzate che definiscono uno scenario di accesso.

Esempio

Esempio 1: Crea un nuovo criterio di accesso condizionale in Azure AD che richiede l'autenticazione a più fattori per accedere a Exchange Online

PS C:\> $conditions = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessConditionSet
PS C:\> $conditions.Applications = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessApplicationCondition
PS C:\> $conditions.Applications.IncludeApplications = "00000002-0000-0ff1-ce00-000000000000"
PS C:\> $conditions.Users = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessUserCondition
PS C:\> $conditions.Users.IncludeUsers = "all"
PS C:\> $controls = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessGrantControls
PS C:\> $controls._Operator = "OR"
PS C:\> $controls.BuiltInControls = "mfa"
PS C:\> New-AzureADMSConditionalAccessPolicy -DisplayName "MFA policy" -State "Enabled" -Conditions $conditions -GrantControls $controls

Id                      : 6b5e999b-0ba8-4186-a106-e0296c1c4358
DisplayName             : MFA policy
CreatedDateTime         : 2019-09-26T23:12:16.0792706Z
ModifiedDateTime        : 2019-09-27T00:12:12.5986473Z
State                   : Enabled

Questo comando crea un nuovo criterio di accesso condizionale in Azure AD che richiede l'accesso a MFA Exchange Online.

Esempio 2: Crea un nuovo criterio di accesso condizionale in Azure AD che blocca l'accesso alle Exchange Online da aree non attendibili

PS C:\> $conditions = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessConditionSet
PS C:\> $conditions.Applications = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessApplicationCondition
PS C:\> $conditions.Applications.IncludeApplications = "00000002-0000-0ff1-ce00-000000000000"
PS C:\> $conditions.Users = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessUserCondition
PS C:\> $conditions.Users.IncludeUsers = "all"
PS C:\> $conditions.Locations = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessLocationCondition
PS C:\> $conditions.Locations.IncludeLocations = "198ad66e-87b3-4157-85a3-8a7b51794ee9"
PS C:\> $controls = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessGrantControls
PS C:\> $controls._Operator = "OR"
PS C:\> $controls.BuiltInControls = "block"
PS C:\> New-AzureADMSConditionalAccessPolicy -DisplayName "MFA policy" -State "Enabled" -Conditions $conditions -GrantControls $controls

Id                      : 6b5e999b-0ba8-4186-a106-e0296c1c4358
DisplayName             : MFA policy
CreatedDateTime         : 2019-09-26T23:12:16.0792706Z
ModifiedDateTime        : 2019-09-27T00:12:12.5986473Z
State                   : Enabled

Esempio 3: Crea un nuovo criterio di accesso condizionale in Azure AD che blocca l'accesso a Exchange Online da dispositivi non conformi

PS C:\> $conditions = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessConditionSet
PS C:\> $conditions.Applications = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessApplicationCondition
PS C:\> $conditions.Applications.IncludeApplications = "00000002-0000-0ff1-ce00-000000000000"
PS C:\> $conditions.Users = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessUserCondition
PS C:\> $conditions.Users.IncludeUsers = "all"
PS C:\> $conditions.Devices = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessDevicesCondition
PS C:\> $conditions.Devices.DeviceFilter = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessFilter
PS C:\> $conditions.Devices.DeviceFilter.Mode = "exclude"
PS C:\> $conditions.Devices.DeviceFilter.Rule = "device.isCompliant -eq True"
PS C:\> $controls = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessGrantControls
PS C:\> $controls._Operator = "OR"
PS C:\> $controls.BuiltInControls = "block"
PS C:\> New-AzureADMSConditionalAccessPolicy -DisplayName "Block Non-compliant device policy" -State "Enabled" -Conditions $conditions -GrantControls $controls

Id               : c5560f6b-2931-4b40-8e94-8b9e11a507c1
DisplayName      : Block Non-compliant device policy
CreatedDateTime  : 2022-04-20T15:15:41.9500079Z
ModifiedDateTime : 
State            : enabled

Questo comando crea un nuovo criterio di accesso condizionale in Azure AD che blocca l'accesso alle Exchange Online da aree non attendibili. Illustra l'utilizzo del filtro per le condizioni dei dispositivi .

Parametri

-Conditions

Specifica le condizioni per i criteri di accesso condizionale in Azure Active Directory.

Type:	ConditionalAccessConditionSet
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-DisplayName

Specifica il nome visualizzato di un criterio di accesso condizionale in Azure Active Directory.

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-GrantControls

Specifica i controlli per i criteri di accesso condizionale in Azure Active Directory.

Type:	ConditionalAccessGrantControls
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Id

{{ Descrizione id riempimento }}

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-SessionControls

{{ Fill SessionControls Description }}

Type:	ConditionalAccessSessionControls
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-State

Specifica lo stato abilitato o disabilitato dei criteri di accesso condizionale in Azure Active Directory.

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False