azure-docs
azure-docs copied to clipboard
MicrosoftDocs
Missing information to setup tenantrestrictions policies
The tenantrestrictions.admx that is delivered as part of Windows mentions the following; "This setting enables and configures the device-based tenant restrictions feature for Azure Active Directory.
When you enable this setting, compliant applications will be prevented from accessing disallowed tenants, according to a policy set in your Azure AD tenant.
Note: Creation of a policy in your home tenant is required, and additional security measures for managed devices are recommended for best protection. Refer to Azure AD Tenant Restrictions for more details.
https://go.microsoft.com/fwlink/?linkid=2148762 "
The information on how to setup a home tenant policy is not provided.
Configuring these settings, basically injects a header in the request such as;
Sec-Restrict-Tenant-Access-Policy: <tenantid>:<policyid>
I would like to know how to configure this further. The WDAC application ID policy has been setup correctly. (otherwise the injected header wouldn't be visible)
Document details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.
- ID: 89ea5c2d-4602-25b8-3cdd-60cfb5c31895
- Version Independent ID: 35d4af7e-72e4-7c40-9dd6-b8490ee73f0d
- Content: Use tenant restrictions to manage access to SaaS apps - Microsoft Entra
- Content Source: articles/active-directory/manage-apps/tenant-restrictions.md
- Service: active-directory
- Sub-service: app-mgmt
- GitHub Login: @vimrang
- Microsoft Alias: vranganathan
@sanderdewit Thanks for your feedback! We will investigate and update as appropriate.
It did found this link, but it's still access denied; https://aka.ms/tenant-restrictions-enforcement Also the page seems to be available under https://aad.portal.azure.com/#view/Microsoft_AAD_IAM/CompanyRelationshipsMenuBlade/~/CrossTenantAccessSettings and the tenant restrictions (preview) category.
The UX was enabled in preparation for public preview but unfortunately, we had to stall public preview due to blocking bugs. We have disabled the UX and it will be hidden once deployment is complete. We will enable the UX and docs as soon as the bugs are fixed.
@sanderdewit the tenant restrictions API is still available, so I wrote a quick guide here: https://tplant.com.au/blog/tenant-restrictions-v2/part-1/. I'll post more details on the optional WDAC component soon
@vimrang TRv2 appears to have entered public preview, will the docs be available soon? That aka.ms link is shown in the UI, but it currently redirects to the internal docs preview environment