Recently we were exploring Azure AD Conditional Access, through which we can define and enforce the organization’s policies regarding access to its resources.
Get more details here
https://docs.microsoft.com/en-gb/azure/active-directory/conditional-access/overview
Here we will define a simple conditional access policy through which we are restricting a user’s access to Common Data Service through Android OS, but allowing the same through the other device platforms.
Login to Azure Admin Portal
Before we can specify a new policy, we need to disable the Enable Security defaults.
Navigate to Azure Active Directory – Properties and click on Manage Security defaults link
Set “Enable Security defaults” to No
Next, Navigate to Security – Conditional Access
Activate the Azure AD Premium trial required to configure conditional access.
Create a new policy.
- For Users and Groups, we have specified the user “testuser1“. The other options available are guest, external users, directory roles and groups.
- For Cloud apps or actions, we have selected Common Data Service
- For Conditions, we have selected only Android as the Device Platform to which the policy should apply.
For Access Controls – Grant we have selected Block Access.
Enable the policy and save.
Let us login through the browser with the testuser1 in windows
Now let us try the same from the Dynamics 365 mobile app from Android.
And the same experience from browser within the Android.
As expected the users is not able to access Dynamics 365 from Android device, and the same user can access from the browser and Dynamics 365 Tablet app from Windows as shown below.
- What if we update the device platform and select Windows as well?
As expected, the user is not able to access both the browser as well as the app from the windows.
- What if we want the user to access it from the browser and only restrict it from a mobile app and desktop client?
Update the policy and specify the below Client Apps condition for that
“Modern authentication clients”
As expected, the user can access through the browser but not the app.
The same experience from within the Android phone.
From browser –
From the Dynamics 365 Mobile App –
Thus we saw how easy it is to get the policy defined and enforced using Azure AD Conditional Access.
Understand the best practices with regards to Conditional Access in Azure Active Directory
https://docs.microsoft.com/en-gb/azure/active-directory/conditional-access/best-practices
Hope it helps..
Nishant Rana's Weblog 
7 thoughts on “How to – Use Azure AD Conditional Access to block user access by device platform (Dynamics 365)”