Hello, everyone. In today’s article, we’ll explain how to force device registration in Azure using terms of use. This control applies to scenarios where administrators want to identify the devices used by users to access applications hosted in Azure.
For this demonstration, we’ll create a term of use, a conditional access policy so the term of use is applied to users, and show how to verify whether the device is registered in the Azure portal and on the user’s device.
Configuring the Term of Use in Azure
Access the terms menu in the conditional access policy via the path Azure AD > Security > Conditional Access Policy > Terms of use, or click this link.
Click New terms.
Let’s configure the term of use following the steps below:
1 – Enter the name of the term of use for tracking in the Azure portal.
2 – Enter the name of the term that will appear to users.
3 – Select the user’s preferred language.
4 – Upload the file with the terms of use policy.
Select the terms of use file in PDF format and click open.
Let’s enable the option that requires the term to be accepted on every device the user uses to access the application. This option requires the user to register their device before receiving the term of use. For more information, visit this link.
1 – Enable the Require users to consent on every device option.
2 – Check the Create conditional access policy later option.
3 – Click Create.
Creating the Conditional Access Policy
Let’s now create the conditional access policy to make the term of use available to users.
Access the Conditional Access Policies menu in Azure, or click this link.
Click New Policy.
For this demonstration, we’ll apply the policy only to user chrystal@ulyneves.com through the steps below:
1 – Enter the policy name in the Name field.
2 – Click Users and groups.
3 – Check the Select users and groups option.
4 – Click Select.
5 – Select the user or group you want to apply the policy to.
6 – Click Select.
7 – Click Done.
Let’s now configure which application will request the term of use. You can apply the same term to all applications hosted in Azure. For this demonstration, we’ll use the Azure management portal.
1 – Click Cloud apps or actions.
2 – Select the Select apps option.
3 – Click Select.
4 – Search for and select the Microsoft Azure Management app.
5 – Click Select.
6 – Click Done.
Let’s now define the control this policy will perform if access matches the scope defined in the previous steps.
1 – In the Access controls menu, select the Grant option.
2 – Select the Grant access option.
3 – Select the term of use created earlier.
4 – Click Select.
Let’s now enable the policy by selecting the ON option in the Enable policy menu.
Click Create.
Accessing the Azure Portal
Let’s test whether the policy is working by accessing the Azure management portal with user chrystal@ulyneves.com.
We can see in the image below that the created policy doesn’t allow the user to access the portal before registering their device in Azure. Let’s click More details.
As shown in the image below, the user’s device is not registered and therefore needs to be registered before accessing the portal. This option to force registration is necessary because we enabled the Require users to consent on every device option when creating the term of use.
Registering the Device in Azure
Let’s register the user’s device in Azure to gain access to the term of use and get access to the Azure management portal.
Click Settings > Accounts > Access work or school.
The configuration window for registering the device in Azure will open.
Click + Connect.
Sign in with the user you want to grant access to the portal. In our demonstration, Chrystal.
Click Next.
We can see in the image above that the device is registered in Azure.
With the device registered in Azure, when accessing the Azure portal again, the term of use is presented to the user.
Click Aceitar.
With the term of use accepted by the user, access to the Azure portal is granted.
Validating the Device Registration
To confirm whether the device was registered in Azure correctly, go to the Azure AD > Devices menu, or click this link.
On the device, open the Windows command prompt and run the following command:
dsregcmd /status
We can see that the device has the Workplacejoined status.
Monitoring the Term of Use
Azure allows you to monitor the terms made available to users. To identify how many users accepted or rejected the term, access the terms of use menu through this link.
Click the number corresponding to the term status column, as shown below:
As shown in the image below, you can see the users and devices used to accept the term of use.
Summary
In today’s article, we showed how to control device registration in Azure using terms of use. We explained how to create a term and apply it using a conditional access policy.
I hope this content has contributed to expanding your knowledge of Azure AD.
Did you like the post? Like and share it. 🙂
If you have any suggestions or comments, let us know.
[ ]’s
Ulysses Neves
