ca-logoThe last couple of weeks I had the privilege to test a feature that has just has been announced today to be released to Microsoft Intune . Conditional access to Outlook Web App and SharePoint Online web access for mobile devices. (CA for web services like OWA and SharePoint for Windows (mobile and PC) is coming up and still in preview)

So basically when a device is not enrolled and / or not compliant Outlook Web App or SharePoint Online web access cannot be accessed via browsers on those devices. Until now this was a major hole in the conditional access story of Exchange Online and SharePoint Online.

So what is the story?

By enabling the new Conditional Access Features in the Exchange Online SharePoint Online Conditional Access policies you are able to block browser access to the service when a device is not enrolled or two enrolled but not compliant.

Let’s see how this looks like for Exchange Online. So let’s first enable the option Block non-compliant devices on the same platform as Outlook like shown below.

Enable CA for OWA

Enable CA for OWA

For Android devices you to go in to the Company Portal to enable Browser Access, this option installs the Work Account certificate on the device. Thus this is only needed for Android, you need to do this otherwise you will be bothered with certificate messages while accessing the web services that are now controlled by conditional access of Intune.

Note: would be nice that an Intune Admin is able to force the installation of the Microsoft Work Account automatically, or that the cert is installed automatically when the service is configured.

Cert message if you do not enable

Cert message if you do not enable browser access



Enable browser access


Cert being installed

After enabling this feature we will see a message appearing when accessing via for instance Google Chrome on an Android device that is not enrolled or not compliant a message Your organization needs you to beef up your security is shown. Notice that while trying to get access the browser is redirected to to check in Azure AD if the device is enrolled and compliant.

Get enrolled or compliant

Get enrolled or compliant

After enrolling the device or making sure that the device is compliant according your compliance policies you will have access to in this case Outlook Web App.

Enabling Conditional Access for SharePoint Online works the same way, easy to configure (like shown below) and the user experience is the same way.

Enable CA for SharePoint Online or OneDrive for business

Enable CA for SharePoint Online or OneDrive for business

Conditional access for browsers is available for the following browsers, other browsers will be blocked.

  • Safari (iOS)
  • Chrome (Android)


Next steps..

When protecting data the next step is to force that the Managed Browser is used to access the web services, since the Managed Browser can also be managed via the Mobile Application Management policies. Forcing traffic coming from the Managed Browser can be done for instance using Active Directory Federation Services and only allowing the Managed Browser to be used while accessing Outlook Web App and SharePoint Online web access. More on this in a later blog which is coming up tomorrow. 🙂