I see a fairly wide hole in the microsoft recommendations for implementing tennant restrictions. As per, https://docs.microsoft.com/en-gb/azure/active-directory/manage-apps/tenant-restrictions#set-up-tenan...
Specifically this line "Modern authentication is enabled as the default authentication protocol for the cloud service."
MS ask you to allow numerous url's, *.sharepoint.com etc etc. to use their cloud services.
However, if a third party sets up a sharepoint or onedrive site without authentication then no tenant control takes effect and files can be uploaded and downloaded without restriction. Giving me DLP and compliance issues.
Does anyone have a way of blocking these other tenants with modern authentication disabled?
Is every enterprise using ms cloud services vulnerable to this? I had hoped CASB could be a potential solution but after talking with Nigel Hawthorn at a BSI event this does not appear to be the case.
Anyone got any suggestions?
Hope you are doing well.
If the malicious actor sets up a Sharepoint site in O365 as tenant, the method mentioned before will work. We insert our tenant id and allowed tenants into the header to restrict where users can go in O365-land. It's not the greatest solution, but it does a sufficient job protecting us from unauthorized tenants.
Where this breaks down is where another tenant has their own ADFS server with their own licensed identities. In that case, there's not much you can do.
The only other option would be to block *.sharepoint.com in one rule, and have a rule immediately above it that whitelisted the approved sites that are *.sharepoint.com (assumes all sites would match that pattern).
You can bypass inspection for your tenant and enforce inspection or block for other tenants: Please see: MWG Filtering Access to Third Party Sharepoint and Onedrive