So, in order to use this I will need additional licenses for Azure Active Directory Premium and Microsoft Intune. PrerequisitesĪzure Active Directory conditional access is not part of the Office 365 enterprise (E3) license. This SharePoint feature facilitates the integration with Intune. For the latter, I will be using a security feature introduced earlier this year. To do this, I will have to enable two conditional access polices and configure SharePoint Online. When using the web browser on an unmanaged device, my employees should not be able to store content on this device (download or sync) or print the content.Should they use any desktop client or mobile app, I want certain conditions to be met. I do not want to restrict these employees very much, but I do want to make sure that no internal content stays on these devices.So, I decided to limit access to the SharePoint Online content. In my scenario I have several employees who access SharePoint Online sites using unmanaged devices (BYOD). Please be aware that when using Intune, this will take precedence over OneDrive for Business or SharePoint Online settings. In this blog I want to go a bit further and look at Azure AD conditional access (Intune) combined with SharePoint Online. These policies effect the use of Office 365 and provide a solid base from which to work from.

Setting a device policy in Office 365 security & compliance

For can have device policies for Office 365 on a whole or for OneDrive for Business /SharePoint Online in particular. The Office 365 admin and security & compliance center do provide us with several options for setting condition access. account (requiring multifactor authentication, for example).device (allowing BYOD with restrictions or company devices only).location (outside of the enterprise or within the enterprise).Most simply put, access to certain resources will only be granted if specific conditions are met. I want to start with a clear definition on conditional access.

Intune policies for office apps