Locking Active Sync in O365 for non-managed devices
can we lock active sync on mobile devices by ADFS using conditional access and work join option?
looking to lock non-work joined ios devices to block access to native email via ADFS or certificate...
looking to lock non-work joined ios devices to block access to native email via ADFS or certificate...
Last Comment
ASKER
device registration does not lock active sync native mail on non-managed devices... any way around that?
Device registration allows you to use the isregistereduser or registrationid, based on which you can allow/block specific or all applications. Or force MFA for them, etc.
ASKER
understand but... does Active Sync connection even go through ADFS to check for isregisteredid? as I understand AS connection does not go ADFS route to do these checks
If it's a federated account, it will pass through the AD FS at least once. That's the whole idea of having federation, your on-prem servers are responsible for authentication and partly authorization.
ASKER
that was my thought process but from what I am told by MS and researching that Active Sync does not go via ADFS. do you know of any claim rule that can check for it at adfs level?
ASKER CERTIFIED SOLUTION
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
ASKER
testing this now and will update with results.
ASKER
The claim rule you need is the "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-client-application",
this link you posted is a broken link... do you have a new link?
this link you posted is a broken link... do you have a new link?
That's not a link, it's the format used for claims rules, URI notation. Read the article above.
ASKER
yes.. got it.
so testing with that claim rule as follows...
I am setting a rule in ADFS to allow all active sync connections without ding permit all.
exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-proxy"])
&& NOT exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-client-application", Value == "Microsoft.Exchange.Active
=> issue(Type = "http://schemas.microsoft.com/authorization/claims/deny", Value = "DenyUsersWithClaim");
or
exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-proxy"])
&& exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-client-application", Value == "Microsoft.Exchange.Active
=> issue(Type = "http://schemas.microsoft.com/authorization/claims/permit", Value = "PermitUsersWithClaim");
none work... any ideas?
so testing with that claim rule as follows...
I am setting a rule in ADFS to allow all active sync connections without ding permit all.
exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-proxy"])
&& NOT exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-client-application", Value == "Microsoft.Exchange.Active
=> issue(Type = "http://schemas.microsoft.com/authorization/claims/deny", Value = "DenyUsersWithClaim");
or
exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-proxy"])
&& exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-client-application", Value == "Microsoft.Exchange.Active
=> issue(Type = "http://schemas.microsoft.com/authorization/claims/permit", Value = "PermitUsersWithClaim");
none work... any ideas?
I've requested that this question be deleted for the following reason:
Not enough information to confirm an answer.
Not enough information to confirm an answer.
ASKER
Solution logically is correct but i am unable to validate it works due to claims not passing correctly.
ASKER
Solution logically is correct but i am unable to validate it works due to claims not passing correctly.
Powershell
Windows PowerShell is a task automation and configuration management framework from Microsoft, consisting of a command-line shell and associated scripting language built on the .NET Framework. PowerShell provides full access to the Component Object Model (COM) and Windows Management Instrumentation (WMI), enabling administrators to perform administrative tasks on both local and remote Windows systems as well as WS-Management and Common Information Model (CIM) enabling management of remote Linux systems and network devices.
27K
Questions
--
Followers
--
Top Experts
Get a personalized solution from industry experts
TRUSTED BY
Alternatively you can use Intune: https://technet.microsoft.com/en-us/library/dn818907.aspx