Conditional Access policies on Azure DevOps – Azure DevOps Services

Source: Microsoft Learn: Build skills that open doors in your career

Author: chcomley

URL: https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/conditional-access-policies?view=azure-devops

https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/conditional-access-policies?view=azure-devops

ONE SENTENCE SUMMARY:

Microsoft Entra ID enables tenant admins to control user access to resources through Conditional Access policies with specific conditions.

MAIN POINTS:

1. Tenant admins use Conditional Access to control access to Microsoft resources.
2. Access is based on conditions like group membership, location, and device.
3. Policies can require multifactor authentication or block access.
4. Policies are set in the Azure portal through “Microsoft Entra Conditional Access.”
5. Azure DevOps requires specific Conditional Access settings.
6. Entra ID checks all Conditional Access policies during web sign-ins.
7. PATs must meet sign-in policies on REST API calls.
8. Azure DevOps supports IP fencing policies for IPv4 and IPv6.
9. ARM Conditional Access policies no longer cover Azure DevOps sign-ins.
10. ARM access is still required for billing and service connection roles.

TAKEAWAYS:

1. Admins have granular control over resource access using Conditional Access.
2. Azure DevOps requires a new specific Conditional Access policy.
3. Multifactor authentication is enforceable for web flows.
4. IP fencing policies enhance security for non-interactive flows.
5. ARM policies must be adjusted for roles needing continued access.