Netskope Global Technical Success (GTS)

Allow Microsoft Apps Access - Specific Corporate Instance

Netskope Cloud Version - 120

Objective

Allow Microsoft Apps Access - Specific Corporate Instance

Prerequisite

Netskope CASB license is required

Context

The customer's requirement is to block access to all Microsoft apps except their Corporate Instance. This document will discuss how to achieve this.

Do You Know?

Before we proceed, let me address some fundamental:

• Microsoft distinguishes between access to Corporate and Personal instances of applications. 
• Netskope is capable of discerning whether traffic is directed towards the Corporate or Personal instance. 
• When an end-user tries to access any Microsoft applications via a browser, they must authenticate first. Authentication occurs through different URLs or domains depending on whether it's for the Corporate or Personal instance.
• Netskope has consolidated all the URLs or domains responsible for authentication and created a cloud app connector for them - 

1. Microsoft Accounts - Corporate Instance
2. Microsoft Live Accounts - Personal Instance

• Microsoft Accounts - As of Oct 14, 2024 with Netskope’s Microsoft Accounts predefined cloud app connector, customers can exercise control over the following activities:

• Microsoft Live Accounts - As of Oct 14, 2024 with Netskope’s Microsoft Live Accounts predefined cloud app connector, customers can exercise control over the following activities:

Configuration

For this lab exercise, let's assume the corporate domain is @cloudtest.com

Step 1 

• @cloudtest.com - Instance mapping

Step 2

• Create a Real-time protection policy

Path - Netskope Tenant UI >>> Policies >>> Real-time Protection >>> New Policy

Policy Number 1

Policy Number 2

Policy Number 3

Step 3

• Policy order

Verification

• Test 1 - Try to login Microsoft O365 Outlook web version via @cloudtest.com credentials and application page should open properly

• Test 2 - Try to login Microsoft O365 Outlook web version via non @cloudtest.com credentials and you will get the below

• Test 3 - Try to login Microsoft Outlook web version and you will get the below

• Test 4 - Check policy hits

Terms and Conditions

• All documented information undergoes testing and verification to ensure accuracy.
• In the future, it is possible that the default settings may be altered. If any such changes are brought to our attention, we will promptly update the documentation to reflect them.

Notes

• This article is authored by Netskope Global Technical Success (GTS).
• For any further inquiries related to this article, please contact Netskope GTS by submitting a support case with 'Case Type – How To Questions'.