MS office 365 tenant restrictions - how to make them work in all cases?

[AndrewH]

Morning,

I see a fairly wide hole in the microsoft recommendations for implementing tennant restrictions.  As per, https://docs.microsoft.com/en-gb/azure/active-directory/manage-apps/tenant-restrictions#set-up-tenan...

Specifically this line "Modern authentication is enabled as the default authentication protocol for the cloud service."

MS ask you to allow numerous url's, *.sharepoint.com etc etc. to use their cloud services. 

However, if a third party sets up a sharepoint or onedrive site without authentication then no tenant control takes effect and files can be uploaded and downloaded without restriction.  Giving me DLP and compliance issues.  

Does anyone have a way of blocking these other tenants with modern authentication disabled?  

Is every enterprise using ms cloud services vulnerable to this?  I had hoped CASB could be a potential solution but after talking with Nigel Hawthorn at a BSI event  this does not appear to be the case.  

Anyone got any suggestions?  

Many Thanks,

Andrew.

[aloksard]

Hi Andrew,

Hope you are doing well.

https://community.mcafee.com/t5/Web-Gateway/Implementing-Tenant-Restrictions-for-Microsoft-Office-36...

Regards

Alok Sarda

[AndrewH]

Many Thanks for the reply Alok,

But that link is just for implementing the tenant control by inserting the header, which only works if the target site has modern authentication enabled.

If for example a malicious thrid party created an open sharepoint or onedrive site then access would be granted via proxy policy but as no authentication enforced the tenant control does not take effect and intenal user can upload and download without restriction.

Looking for someway to black access to sharepoint or onedrive sites that are not ours.

Thanks,
Andrew.

[AaronT]

Andrew,

If the malicious actor sets up a Sharepoint site in O365 as tenant, the method mentioned before will work.  We insert our tenant id and allowed tenants into the header to restrict where users can go in O365-land.  It's not the greatest solution, but it does a sufficient job protecting us from unauthorized tenants.

Where this breaks down is where another tenant has their own ADFS server with their own licensed identities.  In that case, there's not much you can do.

The only other option would be to block *.sharepoint.com in one rule, and have a rule immediately above it that whitelisted the approved sites that are *.sharepoint.com (assumes all sites would match that pattern).

[jebeling]

You can bypass inspection for your tenant and enforce inspection or block for other tenants: Please see: MWG Filtering Access to Third Party Sharepoint and Onedrive