MCAS | Conditional Access App Control | Session Policy - Block Cut/Copy/Paste

[@tijubrain1]

Great content and excellent presentation. Thank you and keep at it.

[@nadeerbabu872]

Great content 👍Thanks

[@shabeelaboobacker352]

Great video and simply covered critical areas. One question:- How assigning/linking a DLP session policy to a Conditional access policy? We can create many custom DLP policies, in that case how a CA policy identifying which DLP policy is belongs to respective CA policy? Thanks.

[@imranawan7908]

Great video. Can you do the same with Microsoft Outlook, Word and Excel. The exe version on the desktop or a laptop

[@074_soujanyasengupta4]

Great video. thanks. Does session monitoring also detect / block screen sharing?

[@yourtime2602]

This is a great video to start with. Thank you! I have a query. is this used to control only business apps? like in this case there are users who access onedrive personal account on managed devices. Can we control file upload on personal onedrive from managed devices using the browser?

[@soydlm8658]

Excelente videos, Thanks.

[@ConceptsWork]

Glad it helped.

[@vinodsurvase2866]

Liked it 👍

[@priyankareddy3587]

Also, the 2 examples shown in the video are w.r.t browser...can we apply block download or copy paste same policy to desktop apps and mobile apps??

[@ConceptsWork]

No, currently session control policies are only applicable to browser, for rich client applications access policy is created, but that will just block/allow access based on a specific device like corporate owned or not. Session control for rich client may be announced in future.

[@priyankareddy3587]

@@ConceptsWork I have a doubt here..we r creating CA policy in Azure Ad portal .Also we r creating the activity type in session policy where we have option to select apps, conditions etc... My query is if we select ALL CLOUD APPS in Azure Ca policy, but in session policy we give only teams so which policy will override?? Also in session policy we have options to provide conditions..

[@albertnadar123]

Where& how the endpoints will b white listed ? Any specific port will b assigned or will b command fed into firewall/router ?

[@ConceptsWork]

The clients must be able to communicate with all the endpoints listed here - docs.microsoft.com/en-us/cloud-app-security/network-requirements Yes, you can define outbound rules on the firewall.

[@albertnadar123]

@@ConceptsWork as per the, article port 443 for Ip add n and dns names fed to firewall ... hope I understood that right.. Thanks

[@rajbharath1871]

Great video. I would liek to know how can we apply this policy for Domain joined machines instead Intune and AAD Hybrid joined devices. Aso I am not getting Domain joined machine option in Device filter .

[@MSCloudZeroTrustTV]

Very good ! Thank you

[@ConceptsWork]

Glad you liked it!

[@soydlm8658]

This rules also is valid if user use client outlook?

[@ConceptsWork]

No, the session polices will work for browser based sessions only.

[@ramfisdubero6865]

But you can still do screenshot?

[@ConceptsWork]

Yes you can.

[@yashwantsinghnegi8290]

Any video on Azure Sentinel? Like your are sharing on MCAS

[@ConceptsWork]

Not yet, but there will by first week of august.

[@priyankareddy3587]

Great Video..I have few queries....in Conditional Access to configure the app control as Monitor instead of custom policy we need MCAS to be enabled on our tenant?? Is it just to use Custom policy we need MCAS?? To use Conditional Access app control feature itself we need MCAS to be enabled ??

[@ConceptsWork]

When you select app enforced policy then it is not required, but for custom policy and monitor, MCAS license is required.

[@priyankareddy3587]

@@ConceptsWork to use Conditional Access app control (Monitor,Block,custom policy all options available in drop-down) we need MCAS licence.

[@ConceptsWork]

I completely agree, Conditional Access app control require licenses, I was referring to app enforced policy option. But anyways thank you so much, for bringing these details, this means alot and it helps other viewers as well. Thanks Priyanka.

[@prathameshforu]

Any video to block file upload on yahoo or gmail?

[@ConceptsWork]

This is an endpoint DLP capability, as of now there is no video, but that's next in pipeline.

[@amanjha2289]

bro please make video on azure atp pleeese

[@rahmuhammad8355]

Please do MDfE