Restrict Access via Entra/Global Secure Access

Restrict Access via Entra/Global Secure Access

Conditional Access for XMAP

Using Entra and Global Secure Access (GSA) you can apply access policies to XMAP which can evolve over time with your own security requirements.
For example, you can restrict authentication to XMAP to only occur within your trusted network. To do this we will:
  1. Create a trusted network by defining IP ranges
  2. Create a conditional access policy to block access from all networks
  3. Add an exclusion for our trusted network

1. Enable Global Secure Access

  1. Sign in to the Microsoft Entra admin center as a Global Secure Access Administrator.
  2. Browse to Global Secure Access > Settings > Session management > Adaptive access.
  3. Select the toggle to Enable CA Signaling for Entra ID (covering all cloud apps). This will automatically enable CAE signaling for Office 365 (preview).
  4. Browse to Protection > Conditional Access > Named locations.
    1. Confirm you have a location called All Compliant Network locations with location type Network Access. Organisations can optionally mark this location as trusted.

2. Define Trusted Network (Named Locations)

  • Sign in to the Microsoft Entra admin center.
  • Go to Security > Conditional Access > Named locations.
  • Here, create a Named Location for your trusted network by adding specific IP ranges or countries. This will represent your trusted network.

3. Configure Conditional Access Policy

  • Go to Security > Conditional Access > Policies.
  • Create a new Conditional Access Policy.
  • In the Assignments section:
    • Users or workload identities: Select the users or groups this policy applies to.
    • Cloud apps or actions: Select the enterprise app(s) that require protection.
  • Under Conditions, select Locations, then:
    • Choose Any location and Exclude the trusted network you defined earlier.

4. Use Global Secure Access (GSA) for Network Conditions

This step is not required if you just want to restrict access based on IP range.

  • With Global Secure Access, you can control network access based on the security posture. In your Conditional Access policy:
    • Under Conditions, go to Device filters or Network conditions.
    • Set it to require a connection from a trusted network or through Global Secure Access.
    • This will ensure the user must be connected through a trusted network, or using a GSA-secured tunnel, to access the app.

5. Block Access Outside Trusted Network

  • In the Grant section of the policy, select Block access.
  • Ensure the policy is set to only allow access when the user is on a trusted network (or connected through Global Secure Access).

6. Test and Monitor

  • Test the policy by attempting access from both trusted and untrusted networks to ensure it works as expected.
  • Monitor the results using Entra’s Sign-in logs to see if the Conditional Access policy is being applied correctly.

    • Related Articles

    • Connecting to a Cloud Database through Microsoft Access

      Overview This article is for connecting to a cloud database in order to edit non-spatial data through Microsoft Access. This guide is for those using Windows. Method Required Installations Install Microsoft Access (if not installed already) Install ...

    • Setting Up Azure Active Directory Login in XMAP

      Azure Active Directory (AD) Login XMAP can integrate with Azure AD to allow your users to authenticate through your organisation's Microsoft Azure tenant. This means they do not need to remember a username/password and their access can be managed ...

    • Behind the Scenes at Geoxphere

      How We Keep Your Services Running Smoothly By Tom Huntley. October 2024 At Geoxphere, we use the power of cloud computing to deliver secure, reliable, and user-friendly geospatial tools to customers across the UK. Much of this work is hidden behind ...

    • Quick introduction to layers in XMAP

      Overview Layers (points, lines, polygons or base mapping) are stored in Collections on the left of the map. Searching for layers: You can search for layers via the Layer Search tool at the top of the Collections panel. Layer Tools: When you click on ...

    • User interface in XMAP

      Overview This is a brief introduction to the user interface of XMAP and its core elements. 1. The Map Navigation : With a Mouse Pan Drag - click and hold the left mouse button to pan the map around. Zoom in/ Out via mouse wheel Zoom in/Out via using ...