The header contains Contoso's tenant ID and the tenant restrictions policy ID.Īuthentication plane protection: Azure AD uses the header in the authentication request to look up the tenant restrictions policy in the Azure AD cloud. The Windows device adds an HTTP header to the authentication request. Contoso enforces the policy on each Windows device by updating the local computer configuration with Contoso's tenant ID and the tenant restrictions policy ID.Ī user with a Contoso-managed Windows device tries to sign in to an external app using an account from an unknown tenant. You can use tenant restrictions to prevent the user from using some or all external apps while they're signed in with the external account on your network or devices.Ĭontoso configures Tenant restrictions in their cross-tenant access settings to block all external accounts and external apps. With the Tenant restrictions settings included with cross-tenant access settings, you can control the external apps that your Windows device users can access when they're using external accounts.įor example, let's say a user in your organization has created a separate account in an unknown tenant, or an external organization has given your user an account that lets them sign in to their organization.
For more information about previews, see Supplemental Terms of Use for Microsoft Azure Previews.įor increased security, you can limit what your users can access when they use an external account to sign in from your networks or devices. The Tenant restrictions settings, which are included with cross-tenant access settings, are preview features of Azure Active Directory.
0 kommentar(er)
