Difference between revisions of "Office365 Exchange Online Restrict Access"

From Michael's Information Zone
Jump to navigation Jump to search
Line 3: Line 3:
  
 
==Restrict OWA access based on client IP==
 
==Restrict OWA access based on client IP==
−
First, we need to log into exchange online.
+
===Access to Exchange Onlone===
 +
Install needed modules
 +
<pre>
 +
 
 +
</pre>
 +
Log into exchange online.
 
<pre>
 
<pre>
 
$livecred = get-credential
 
$livecred = get-credential
Line 9: Line 14:
 
import-pssession $session
 
import-pssession $session
 
</pre>
 
</pre>
−
*According to MS, you should create a priority 1 rule so that you do not accidentally lock yourself out. When first starting out there are no rules in a relatively fresh Office365 configuration. Running "get-clientaccessrule" returns nothing.
+
 
 +
*According to MS, you should create a priority 1 rule so that you do not accidentally lock yourself out. When first starting out there are no rules in a relatively fresh Office365 configuration. Running "get-clientaccessrule" returns nothing, so run the following so not to shoot yourself in the foot.
 
<pre>
 
<pre>
 
New-ClientAccessRule -Name AllowRemotePS -Action Allow -AnyOfProtocols RemotePowerShell -Priority 1
 
New-ClientAccessRule -Name AllowRemotePS -Action Allow -AnyOfProtocols RemotePowerShell -Priority 1
 
</pre>
 
</pre>
−
*
+
 
 +
Now check existing rules
 +
<pre>
 +
 
 +
PS C:\Users\michael.mast> Get-ClientAccessRule
 +
 
 +
Name            Priority Enabled DatacenterAdminsOnly
 +
----            -------- ------- --------------------
 +
AllowRemotePS  1        True    False
 +
OWA_Exceptions  2        True    False
 +
TEST_OWA        3        False  False
 +
OWA            4        True    False
 +
activesync_test 5        True    False
 +
</pre>
 +
 
 +
To get the actual settings for a rule, you have to format the object as a list.
 +
<pre>
 +
PS C:\Users\michael.mast> Get-ClientAccessRule -Identity activesync_test | Format-List
 +
 
 +
 
 +
RunspaceId                          : ff060c35-8e77-49a4-b971-072bb94b1de4
 +
Priority                            : 5
 +
Enabled                              : True
 +
DatacenterAdminsOnly                : False
 +
Action                              : DenyAccess
 +
AnyOfClientIPAddressesOrRanges      : {}
 +
ExceptAnyOfClientIPAddressesOrRanges : {xxx.xxx.xxx.xxx/24}
 +
AnyOfSourceTcpPortNumbers            : {}
 +
ExceptAnyOfSourceTcpPortNumbers      : {}
 +
UsernameMatchesAnyOfPatterns        : {*michael.mast}
 +
ExceptUsernameMatchesAnyOfPatterns  : {}
 +
UserIsMemberOf                      : {}
 +
ExceptUserIsMemberOf                : {}
 +
AnyOfAuthenticationTypes            : {}
 +
ExceptAnyOfAuthenticationTypes      : {}
 +
AnyOfProtocols                      : {ExchangeActiveSync}
 +
ExceptAnyOfProtocols                : {}
 +
UserRecipientFilter                  :
 +
Scope                                : All
 +
AdminDisplayName                    :
 +
ExchangeVersion                      : 0.20 (15.0.0.0)
 +
Name                                : activesync_test
 +
DistinguishedName                    : CN=activesync_test,CN=Client Access Rules,CN=Configuration,CN=xxx.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR20A005,DC=PROD,DC=OUTLOOK,DC=COM
 +
Identity                            : activesync_test
 +
ObjectCategory                      : NAMPR20A005.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Client-Access-Rule
 +
ObjectClass                          : {top, msExchClientAccessRule}
 +
WhenChanged                          : 4/30/2018 1:53:19 PM
 +
WhenCreated                          : 4/30/2018 1:00:11 PM
 +
WhenChangedUTC                      : 4/30/2018 5:53:19 PM
 +
WhenCreatedUTC                      : 4/30/2018 5:00:11 PM
 +
Id                                  : activesync_test
 +
Guid                                : xxx
 +
OriginatingServer                    : MWHPR20A005DC08.NAMPR20A005.PROD.OUTLOOK.COM
 +
IsValid                              : True
 +
ObjectState                          : Changed
 +
</pre>
  
 
==Notes==
 
==Notes==

Revision as of 10:51, 28 September 2018

Purpose

To restrict access to email to specific applications, locations, and users.

Restrict OWA access based on client IP

Access to Exchange Onlone

Install needed modules

Log into exchange online. 

$livecred = get-credential
$session = New-PSSession -configurationname microsoft.excahnge -connectionuri https://ps.outlook.com/powershell/ -credential $livecred -authentication basic -allowredirection
import-pssession $session
  • According to MS, you should create a priority 1 rule so that you do not accidentally lock yourself out. When first starting out there are no rules in a relatively fresh Office365 configuration. Running "get-clientaccessrule" returns nothing, so run the following so not to shoot yourself in the foot.
New-ClientAccessRule -Name AllowRemotePS -Action Allow -AnyOfProtocols RemotePowerShell -Priority 1

Now check existing rules 


PS C:\Users\michael.mast> Get-ClientAccessRule

Name            Priority Enabled DatacenterAdminsOnly
----            -------- ------- --------------------
AllowRemotePS   1        True    False
OWA_Exceptions  2        True    False
TEST_OWA        3        False   False
OWA             4        True    False
activesync_test 5        True    False

To get the actual settings for a rule, you have to format the object as a list. 

PS C:\Users\michael.mast> Get-ClientAccessRule -Identity activesync_test | Format-List


RunspaceId                           : ff060c35-8e77-49a4-b971-072bb94b1de4
Priority                             : 5
Enabled                              : True
DatacenterAdminsOnly                 : False
Action                               : DenyAccess
AnyOfClientIPAddressesOrRanges       : {}
ExceptAnyOfClientIPAddressesOrRanges : {xxx.xxx.xxx.xxx/24}
AnyOfSourceTcpPortNumbers            : {}
ExceptAnyOfSourceTcpPortNumbers      : {}
UsernameMatchesAnyOfPatterns         : {*michael.mast}
ExceptUsernameMatchesAnyOfPatterns   : {}
UserIsMemberOf                       : {}
ExceptUserIsMemberOf                 : {}
AnyOfAuthenticationTypes             : {}
ExceptAnyOfAuthenticationTypes       : {}
AnyOfProtocols                       : {ExchangeActiveSync}
ExceptAnyOfProtocols                 : {}
UserRecipientFilter                  :
Scope                                : All
AdminDisplayName                     :
ExchangeVersion                      : 0.20 (15.0.0.0)
Name                                 : activesync_test
DistinguishedName                    : CN=activesync_test,CN=Client Access Rules,CN=Configuration,CN=xxx.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR20A005,DC=PROD,DC=OUTLOOK,DC=COM
Identity                             : activesync_test
ObjectCategory                       : NAMPR20A005.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Client-Access-Rule
ObjectClass                          : {top, msExchClientAccessRule}
WhenChanged                          : 4/30/2018 1:53:19 PM
WhenCreated                          : 4/30/2018 1:00:11 PM
WhenChangedUTC                       : 4/30/2018 5:53:19 PM
WhenCreatedUTC                       : 4/30/2018 5:00:11 PM
Id                                   : activesync_test
Guid                                 : xxx
OriginatingServer                    : MWHPR20A005DC08.NAMPR20A005.PROD.OUTLOOK.COM
IsValid                              : True
ObjectState                          : Changed

Notes

  • Want to use email containerization for devices outside the LAN. Internal users can access from terminal servers or virtual desktops.
  • Client access rules can be used to restrict access to just the datacenter using IP whitelisting.[1][2]
  • Conditional access could be used, but appears to not support all email clients[3][4]
  • Activesync device access might be ideal if you can restrict based on application family. For example; Sophos Secure Email containers show up starting with "SecurePIM" in the name. If you could only allow devices that fall within this family, and no other mail client uses this family, then you would have restricted access.[5][6]



There are two methods to follow

  1. A restrictive technical control model
  2. A less restrictive policy based model


In the first model we would restrict access to exchange online to the datacenter, then run a proxy. In the less restrictive model we would tell users they are not allowed to use any other client except the approved app, then monitor for violations using auditing[7][8]. If a violation occurs business can handle disciplinary messures.

It may be possible to restrict access for MAPI clients using Client access rules, then restrict activesync connections using ActiveSync Device Access and specifying the device family.

  1. ↑ https://technet.microsoft.com/en-us/library/mt842508
  2. ↑ https://technet.microsoft.com/en-us/library/mt842507(v=exchg.150).aspx
  3. ↑ https://core.co.uk/blog/restricting-access-office-365/
  4. ↑ https://docs.microsoft.com/en-us/azure/active-directory/active-directory-conditional-access-mam
  5. ↑ https://blogs.technet.microsoft.com/exchange/2010/11/15/controlling-exchange-activesync-device-access-using-the-allowblockquarantine-list/
  6. ↑ https://social.technet.microsoft.com/Forums/msonline/en-US/6559babe-7d09-4f91-a2d7-fc0b58d3cb4f/office-365-device-access-rules?forum=onlineservicesexchange
  7. ↑ https://blogs.technet.microsoft.com/exovoice/2017/03/14/how-to-see-the-ip-addresses-from-where-your-office-365-users-are-accessing-owa/
  8. ↑ https://support.office.com/en-us/article/Enable-mailbox-auditing-in-Office-365-aaca8987-5b62-458b-9882-c28476a66918
Retrieved from "https://wiki.1701technology.com/index.php?title=Office365_Exchange_Online_Restrict_Access&oldid=950"