Conditional Access Deployment

Conditional Access policies are, at their most basic, an if-then statement combining signals to make decisions, and to enforce organization policies. Zero Trust Access to Microsoft 365 applications can be configured by integrating CloudGen Access with the Microsoft Entra Conditional Access feature.  Note that conditional access requires an extended Azure license (Microsoft Entra ID Premium).

This deployment option requires a proxy with a public IP address. You need to deploy and host proxy.

1. Create a named location.  
   Locations are found under Protection > Conditional Access > Named locations. 
   1. Create a location with proxy IP addresses.
      
      
      

2. Create below resources. 
   Create self-hosted web resources from the CloudGen Access management console:

   *.aadg.akadns.net 

   *.msidentity.com 

   outlook.office365.com 

   *.aadg.trafficmanager.net 

   login.microsoftonline.com 

   Login.windows.net 

   
   
   
   

3. Create a policy. 
   Example policy: This policy blocks access to Microsoft 365 applications from all locations, excluding the “named location (Proxy IP)” for all or selected users and groups.
   1. Select users of the policy.
      
      
   2. Select the Office 365 application. If you are using Microsoft Entra ID as an Identity Provider for CloudGen Access, do not forget to exclude it from the target resources. 
      
      
   3. Set conditions. You can enforce this policy to all locations, excluding the “named location” you created.
      
      
   4. Finally, select Block Access next to Grant.