Hi everyone. Welcome. My name is Jason Rutherford and I’m the Managing Partner for Model Technology Solutions. Today I’m going to show you Microsoft’s cloud access security broker (CASB) implements Dynamic Access Control and a specific use case scenario that we ran across recently.
How Microsoft’s CASB Implements Dynamic Access Control (A Use Case)
Let’s say you have a SharePoint site and you want to control the data and how users interact with that SharePoint site when they’re on a browser from a non-trusted machine. For example, they’re working from home and you want to prevent them from downloading data from SharePoint.
Now, the users might be full admins of the actual SharePoint site itself, and that’s okay. But when they’re at home on a non-trusted device and you really can’t protect that data anymore, you want to limit what they can do.
Here’s a visual of how that can work. This screenshot is Model’s marketing site and the blog calendar from 2017 in SharePoint.
Let’s say that I wanted to download the calendar. Notice I can download it because I’m on a trusted device.
Now let’s open up a browser on a non-trusted device as an account with a different policy applied to it. The first thing you’ll notice is we receive a warning that the SharePoint site is being monitored.
This is a feature of Microsoft’s CASB. As a user we can choose hide this message for a week, and as an admin we can turn it off entirely if desired.
Now, if you choose to continue to the site, and you go back to our blog schedule and try to download it, we now see that the download is being blocked by our organization’s security policy with a message that says, “You’ve been blocked by a session policy, contact Jason Rutherford, cloud app security.” This is actually a customized message you can set.
To execute this, there’s a conditional access policy that takes a specific user and gap under the condition and flips it over to use the control access app or session control app from Microsoft’s CASB.