Conditional Access Best Practices
Setup your Conditional Access policies for CIPP.
To make sure CIPP is able to access your tenants securely we recommend the usage of Conditional Access. Both your, and your clients Conditional Access Policies will need to be configured for optimal usage.
Setup of Your Conditional Access Policies
Open Azure
Browse to the Conditional Access Policies blade in Azure.
Create CIPP Specific Policy
Create a new policy and include the CIPP user. Enforce Azure Multi-Factor Authentication for each logon (set sign in frequency under session to every time) and for all cloud applications. Do not add any exclusions or trusted locations.
If you have trusted locations under the classic MFA portal you must always remove those.
Save this policy under the name "CIPP Service Account Conditional Access Policy"
Setup of Clients' Conditional Access Policies
GDAP is affected by your clients' conditional access policies. To make sure you can access your clients using your CIPP integration user we recommend excluding the MSP from the Conditional Access Policy per Microsoft's Documentation
Open Azure
Browse to your client's Conditional Access Policies blade in Azure.
Edit Conditional Access Policies
For each policy listed. Add an exclusion to "Users and Groups" with the following settings:
Guest or external users
Service Provider Users
Selected
Enter your tenant ID. If you do not know what your tenant ID is, you can look this up here.
If you have any Microsoft-Managed Conditional Access policies showing up in your client tenants, these are an indication from Microsoft that they do not feel that your client's tenant meets minimum security posture. These policies cannot be deleted but they can be cloned and then disabled.
Optional: If you are running in Direct Tenant mode, exclude the CIPP service account for this tenant instead of the tenant exclusion.
Last updated
Was this helpful?