Conditional Access app control lets you allow a cloud app on an unmanaged device while controlling what happens inside the session: block downloads, label files on download, stop copy and print. The setup spans two portals, and most problems come from a gap between them. In this post I'll explain the routing, build the Microsoft Entra policy and a session policy, test them, and decode the common errors.
Errors this guide fixes
This website is blocked by your organizationBrowser (user session)Download restrictedBrowser (session policy block)You don't have any apps deployed with conditional access app controlMicrosoft Defender portal (create policy)No apps connectedDefender portal (CA App Control apps page)App is not recognizedBrowser (proxied session)Request session controlDefender portal (CA App Control apps page)Continue SetupBrowser / app status (non-Microsoft IdP app)This site isn't secureBrowser (proxied session)
How it works#
- A Microsoft Entra Conditional Access policy with the session control Use Conditional Access App Control sends matching sign-ins to Defender for Cloud Apps. The built-in options are Monitor only and Block downloads; Use custom policy hands control to the access and session policies you build in Defender.
- Users in Microsoft Edge for Business (signed in with their work profile) get in-browser protection, shown by a lock icon in the address bar, as long as every policy that applies to them is supported there. Other browsers go through a reverse proxy, and the URL gains a suffix:
myapp.combecomesmyapp.com.mcas.ms(*.mcas-gov.usor*.mcas-gov.msin government clouds). - Session controls only apply to browser sessions (Microsoft supports the latest Edge, Chrome, Firefox and Safari). Desktop and mobile clients, including the Teams desktop app, aren't covered, so block them with an access policy or users can simply bypass the browser.
- Microsoft Entra ID apps (SAML 2.0, OpenID Connect and Application Proxy apps) are onboarded automatically. Apps that use another identity provider must be onboarded manually.
- When two session policies match, the more restrictive one wins.
Prerequisites#
- A Defender for Cloud Apps license and Microsoft Entra ID P1. The Protect action also needs Microsoft Purview Information Protection with a sensitivity label that applies encryption.
- At least the Conditional Access Administrator role to create the Entra policy.
- The Microsoft Defender for Cloud Apps - Session Controls enterprise app must not be blocked. Exclude it from "block all apps" policies and include it in location-based policies. If the service principal is missing, create it:
Connect-MgGraph -Scopes "Application.ReadWrite.All"
New-MgServicePrincipal -AppId 8a0c2593-9cbc-4f86-a247-beb7aab00d83Step-by-step#
1. Route sessions with Conditional Access#
- In the Microsoft Entra admin center, go to Entra ID › Conditional Access › Policies › New policy.
- Assign a pilot group, and exclude your emergency access accounts.
- Under Target resources › Resources, select the apps, for example Office 365 or a SaaS app that uses Entra single sign-on.
- Add conditions, such as browser access from devices that aren't compliant.
- Under Access controls › Session, select Use Conditional Access App Control and choose Use custom policy.
- Start in Report-only and switch to On when the results look right (see What If and report-only mode).
2. Build the session policy#
In the Microsoft Defender portal, open Cloud Apps › Policies › Policy management, select the Conditional Access tab, then Create policy › Session policy:
- Session control type: Control file download (with inspection). The other types are Monitor only (which records only the sign-in), Block activities (print, copy, send) and Control file upload (with inspection).
- Activity filters: the app, plus a device tag filter that excludes Intune compliant and Hybrid Azure AD joined devices. Without an app filter, the policy covers every app enabled on the Conditional Access App Control apps page.
- Files: a sensitivity label, extension, file name or size, and an inspection method such as Data Classification Service or malware detection.
- Action: Block (optionally email the user and customize the message) or Protect, which applies a sensitivity label to Word, Excel, PowerPoint and PDF files on download. Protect doesn't overwrite a label the file already has.
3. Close the desktop-client bypass#
Create an access policy with the Client app filter set to Mobile and desktop and the action Block, with a message such as "You must use a web browser to access this app." Without that filter, access policies only apply to browser sessions.
4. Decide what users see#
By default users are told their session is monitored; change or clear that under Settings › Cloud Apps › Conditional Access App Control › User monitoring. When a download is blocked, users see Download restricted and get a text file, with your message, instead of the document. Also review Default behavior in the same settings area, which decides whether sessions are allowed or blocked if the service can't enforce policies.
Verify#
- Sign out of all sessions, then sign in as a pilot user from an unmanaged device in a private window.
- In Chrome, Firefox or Safari the address should end in
.mcas.ms; in Edge for Business you should see the lock icon. - Download a file that matches the policy: you should get the block message or a labeled copy.
- In the Defender portal, open the policy in Policy management: its report lists redirected sign-ins and blocked or protected downloads. The Activity log shows each matching activity, and the Microsoft Entra sign-in log shows which Conditional Access policy applied the session control.
Tips and gotchas: common errors#
| Message or symptom | Likely cause | What to do |
|---|---|---|
This website is blocked by your organization | An access or session policy, the Block access default behavior, or (with no suffix or lock icon) an unsanctioned app blocked by Defender for Endpoint | Find the policy in the Entra sign-in log and the Activity log; see unsanctioned app blocks |
You don't have any apps deployed with conditional access app control / No apps connected | A non-Microsoft IdP app that isn't onboarded | Onboard the app, then create the policy |
| Entra app missing from the apps page | Entra apps appear once a policy names them, or after a user signs in under a policy with no app filter | Add the app to a policy, or sign in to it through the Conditional Access policy |
App is not recognized | Custom app with Entra single sign-on that isn't in the catalog | Settings › Cloud Apps › Connected apps › Conditional Access App Control apps, select View new apps, then add the app and its domains |
Request session control / Continue Setup | Non-catalog or unfinished non-Microsoft IdP app | Complete the custom app onboarding |
This site isn't secure or "There's no internet connection" | Firewall or TLS problem on the proxy path | Allow outbound 443 to the Defender for Cloud Apps addresses for your data center; make sure TLS 1.2 is enabled |
| Conditional Access App Control option missing in Entra | Licensing | Confirm Entra ID P1 and Defender for Cloud Apps licenses |
| Protect action grayed out | No Purview license or integration | Check the Microsoft Purview license and the Microsoft Information Protection integration setting |
For anything else, add your admin account under Settings › Cloud Apps › Conditional Access App Control › App onboarding/maintenance and allow it to bypass from inside a proxied session. The Admin View toolbar then appears in proxied sessions, with Bypass experience (is the proxy the problem?), Record session (for support) and Discovered domains (domains not yet associated with the app).
