microsoft/conditionalaccessforzerotrustresources

ConditionalAccessforZeroTrustResources holding resources for Azure AD CA guidance for Zero Trust

Project

This repository holds some Conditional Access resources that complement the Azure Architecture design note "Conditional Access Guidance for Zero Trust". See more here for a description on CA configured for Zero Trust

https://docs.microsoft.com/en-us/azure/architecture/guide/security/conditional-access-zero-trust?msclkid=d1768a34ceda11ec9b6c8f244f8d05bd and

• Detailed guidance as PDF documents on Conditional Access Guidance that complements the formal documentation. Latest updates from October 2023
• ConditionalAccessSamplePolicies folder holds an Excel Spreadsheet documenting the suggested set of policies
• ConditionalAccessSamplePolicies\Microsoft365DSCCAGroups folder has a Microsoft365dsc file to automate the creation of groups used for the CA policies
• ConditionalAccessSamplePolicies\Microsoft365DSCCAPolicies folder has a Microsoft365dsc file to automate the creation of CA policies
• ToolBox folder has a few helper scripts. Open the script for furhter information.
• Workbooks folder has enhanced workbooks to look at CA policies and compliancy as well as a troubleshooing solution for Always-On VPN including a workbook for that.
• Presentations folder has a few presentations that I have given about CA configured for Zero Trust
• ConditionalAccessSamplePoliciesTerraform folder holds sample code to be used from GitHub Actions based on Terraform. Thanks to Suryendu Bhattacharyya, https://www.linkedin.com/in/suryendub/

see other readme files in the sub-folders for further details.

PS! I would like to thank contributors, and those who have made PRs. This is much appreciated. If I am too slow in looking at and potentially approve any PRs, feel free to ping me on channels like LinkedIn for us to have a chat.

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.

When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

Trademarks

This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.

conditionalaccessforzerotrustresources's Issues

Need for prerequisite

Why is a "Device with WinRM configured with a HTTPS listener" required as a prerequisite? what will this be needed for?

build.ps1 fails on .\ConfigureMicrosoft365.ps1

During the build phase a script is called, which is not being found. Has this one been removed/renamed?

Intune Enrollment was removed from some exclusions

Hi @clajes ,

I saw that commit fbe014a is removing intune enrollment app from some exclusions, which seems a bit odd and different from what is in the pdf guidance. Can you share what was the intention behind that change?

Thanks

"CA406-Guests-DataProtection-AllApps-AnyPlatform-SignInSessionPolicy" configuration error

M365TenantConfig.ps1

This file has ApplicationID and ApplicationSecret configured in policy "CA406-Guests-DataProtection-AllApps-AnyPlatform-SignInSessionPolicy"

this information does not exist in ConfigurationData.psd1 nor are there any references to what this application should and how it should be configured.

This generates the following error:
PSDesiredStateConfiguration\Node : Cannot bind argument to parameter 'String' because it is null.
At C:\Users\aadwimal01\Documents\ConditionalAccessforZeroTrustResources-main\ConditionalAccessforZeroTrustResources-main\ConditionalAccessSamplePolicies\Microsoft365DSCC
APolicies\M365TenantConfig1.ps1:31 char:5

• Node localhost
  

• ~~~~
  

  • CategoryInfo : InvalidData: (:) [PSDesiredStateConfiguration\node], ParentContainsErrorRecordException
  • FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,PSDesiredStateConfiguration\node

Please advise!

CA100-Admins-BaseProtection-AllApps-AnyPlatform-CompliantorAADHJ is CompliantorMFA

Hi @clajes !
It seems that CA100-Admins-BaseProtection-AllApps-AnyPlatform-CompliantorAADHJ is CompliantorMFA and not CompliantorAADHJ. Also, the pdf has a CA101 for Admins MFA which is not in sample policies, but at the same time it also enforces MFA on MFAforHighSigninRisk, which seems duplicate.

Can you help to clarify if this was a type or if you changed your point of view somehow around admins for some reason? Internals seem to have a more coherent approach, with CompliantorAADHJ and MFAforHighSignInRisk.
Thanks

can not find Conditional access for powerapp service in Azure China

Conditional Access --- create new policy --- select Cloud apps or actions -- can not search powerapp

as powerapp is available in O365 Azure China , but can not find in the conditional access in Azure portal

please help to confirm whether the conditional access is available for powerapp

Creation of policies

please delete