ADFS/WAP - Applying Access Control Policy to WAP only?

divadiow 1 Reputation point
2020-07-13T12:40:28.337+00:00

I need to restrict external ADFS access through the WAP to a certain relying party trust (365 federation) to only those in a particular AD group. I need all other internal ADFS requests to remain as "permit all"

Can I apply a policy to the WAPs only for a single relying party?

Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,249 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
21,438 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Marilee Turscak-MSFT 36,841 Reputation points Microsoft Employee
    2020-07-13T20:14:22.073+00:00

    Your non-Office 365 apps which utilize ADFS for authentication won't be able to use the Azure AD conditional access policies. You'll need to set up access control policies within ADFS for them since the auth requests for those apps don't touch Azure AD.

    If you look at this chart you'll see that conditional access isn't supported with WAP. Web Application Proxy is only preferred in scenarios that require a proxy server for AD FS. If you want to make use of Conditional Access you need to modify the federation to use Azure AD instead of ADFS.

    Official documentation:

    https://video2.skills-academy.com/en-us/azure/active-directory/manage-apps/application-proxy-add-on-premises-application

    https://video2.skills-academy.com/en-us/azure/active-directory/manage-apps/application-proxy-migration

    A good blog post on this topic.

    0 comments
  2. divadiow 1 Reputation point
    2020-08-03T19:17:32.19+00:00

    OK thank you.

    I think I'm being dumb

    I want to allow access to a particular RPT from:

    1 everyone internally 2 only those in particular AD group over the internet

    I've a singe Access Control Policy with two rules:

    1 Permit Users - from intranet network 2 Permit Users - from internet network - and from DOMAIN\ADGROUP group

    the text above the rules states "permit access if any of the following rules are met"

    Are the conditions on the second rule not correct for allowing users in a certain group external access? Intranet access is fine.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.