Dynamic Data Access | Security Through Session-Level Controls

Hi everyone. Welcome. My name is Jason Rutherford and I’m the Managing Partner for Model Technology Solutions. Today I’m going to show you Microsoft’s cloud access security broker (CASB) implements Dynamic Access Control and a specific use case scenario that we ran across recently.

How Microsoft’s CASB Implements Dynamic Access Control (A Use Case)

Let’s say you have a SharePoint site and you want to control the data and how users interact with that SharePoint site when they’re on a browser from a non-trusted machine. For example, they’re working from home and you want to prevent them from downloading data from SharePoint.

Now, the users might be full admins of the actual SharePoint site itself, and that’s okay. But when they’re at home on a non-trusted device and you really can’t protect that data anymore, you want to limit what they can do.

Here’s a visual of how that can work. This screenshot is Model’s marketing site and the blog calendar from 2017 in SharePoint.

Let’s say that I wanted to download the calendar. Notice I can download it because I’m on a trusted device.

Now let’s open up a browser on a non-trusted device as an account with a different policy applied to it. The first thing you’ll notice is we receive a warning that the SharePoint site is being monitored.

This is a feature of Microsoft’s CASB. As a user we can choose hide this message for a week, and as an admin we can turn it off entirely if desired.

Now, if you choose to continue to the site, and you go back to our blog schedule and try to download it, we now see that the download is being blocked by our organization’s security policy with a message that says, “You’ve been blocked by a session policy, contact Jason Rutherford, cloud app security.” This is actually a customized message you can set.

To execute this, there’s a conditional access policy that takes a specific user and gap under the condition and flips it over to use the control access app or session control app from Microsoft’s CASB.

From there, we can take a look at the policies that we have set up on our conditional access and create a new policy to block downloads from SharePoint online.

If you click on a specific policy, you can edit it and also create the custom message here.

If you’d like to hear more about Microsoft CASB or Microsoft security products in general, as it relates to cloud data or Unified Endpoint Management, don’t hesitate to reach out to us at model-technology.com/contact-us.