cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

MS office 365 tenant restrictions - how to make them work in all cases?

Morning,

I see a fairly wide hole in the microsoft recommendations for implementing tennant restrictions.  As per, https://docs.microsoft.com/en-gb/azure/active-directory/manage-apps/tenant-restrictions#set-up-tenan...

Specifically this line "Modern authentication is enabled as the default authentication protocol for the cloud service."

MS ask you to allow numerous url's, *.sharepoint.com etc etc. to use their cloud services. 

However, if a third party sets up a sharepoint or onedrive site without authentication then no tenant control takes effect and files can be uploaded and downloaded without restriction.  Giving me DLP and compliance issues.  

Does anyone have a way of blocking these other tenants with modern authentication disabled?  

Is every enterprise using ms cloud services vulnerable to this?  I had hoped CASB could be a potential solution but after talking with Nigel Hawthorn at a BSI event  this does not appear to be the case.  

Anyone got any suggestions?  

Many Thanks,

Andrew.

 

 

4 Replies
McAfee Employee aloksard
McAfee Employee
Report Inappropriate Content
Message 2 of 5

Re: MS office 365 tenant restrictions - how to make them work in all cases?

Re: MS office 365 tenant restrictions - how to make them work in all cases?

Many Thanks for the reply Alok,

But that link is just for implementing the tenant control by inserting the header, which only works if the target site has modern authentication enabled.

If for example a malicious thrid party created an open sharepoint or onedrive site then access would be granted via proxy policy but as no authentication enforced the tenant control does not take effect and intenal user can upload and download without restriction.

Looking for someway to black access to sharepoint or onedrive sites that are not ours.

Thanks,
Andrew.
Reliable Contributor AaronT
Reliable Contributor
Report Inappropriate Content
Message 4 of 5

Re: MS office 365 tenant restrictions - how to make them work in all cases?

Andrew,

If the malicious actor sets up a Sharepoint site in O365 as tenant, the method mentioned before will work.  We insert our tenant id and allowed tenants into the header to restrict where users can go in O365-land.  It's not the greatest solution, but it does a sufficient job protecting us from unauthorized tenants.

Where this breaks down is where another tenant has their own ADFS server with their own licensed identities.  In that case, there's not much you can do.

The only other option would be to block *.sharepoint.com in one rule, and have a rule immediately above it that whitelisted the approved sites that are *.sharepoint.com (assumes all sites would match that pattern).

 

McAfee Employee jebeling
McAfee Employee
Report Inappropriate Content
Message 5 of 5

Re: MS office 365 tenant restrictions - how to make them work in all cases?

You can bypass inspection for your tenant and enforce inspection or block for other tenants: Please see: MWG Filtering Access to Third Party Sharepoint and Onedrive

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community