Is there a way to block "Microsoft Azure PowerShell" for all users?

Question

Is there a way to block "Microsoft Azure PowerShell" for all users?

Andy Goldberg 0

Greetings,

I'm afraid that this one can't be blocked by design, but I will ask anyway. Is there a way to block login attempt from Microsoft Azure PowerShell? We are constantly probed from all around the world, and I can't see to figure out how to block this. We are blocking all unused apps via Conditional Access Rules, plus there is a geolocation filter, but it kicks in only after successful authentication.

azure_powershell

azure_powershell2

0 comments

3 answers

Your answer

Answer 1

**CA policies can only target apps that have a service principle registered. To fix this you need to create a service principle using GraphApi/Explorer or PowerShell.

Step 1 — Create the service principal via Graph Explorer:**

Method: POST

URL: https://graph.microsoft.com/v1.0/servicePrincipals

Body:

{ "appId": "1b730954-1685-4b74-9bfd-dac224a7b894" }


**Step 2 — Create CA policy using Graph Explorer (REPORT ONLY FIRST, THEN ENABLE)**

Method: POST

URL: https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies

Body:


```json
{
  "displayName": "Block App 
  "state": "enabledForReportingButNotEnforced",
  "conditions": {
    "clientAppTypes": ["all"],
    "applications": {
      "includeApplications": ["1b730954-1685-4b74-9bfd-dac224a7b894"],
      "excludeApplications": []
    },
    "users": {
      "includeUsers": ["All"],
      "excludeUsers": [],
      "excludeGroups": [],
      "excludeRoles": []
    }
  },
  "grantControls": {
    "operator": "OR",
    "builtInControls": ["block"]
  }
}

Answer 2

Gudivada Adi Navya Sri 21,095 Moderator

Hi @Andy Goldberg

Thank you for posting this in Microsoft Q&A.

I understand that you want to know way to block "Microsoft Azure PowerShell" for all users.

You can use conditional access policy or script to block Microsoft Azure PowerShell for all users in Entra. I noticed that you have already tried the conditional access policy.

Please follow the steps which mentioned in this document: Blocking Powershell

Hope this helps. Do let us know if you any further queries.

Thanks,

Navya.

Gudivada Adi Navya Sri 21,095 Reputation points Moderator

2024-03-27T12:01:44.3033333+00:00

Hi @Andy Goldberg

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer And, if you have any further query do let us know.

Answer 3

Marcin Policht 86,615 MVP Volunteer Moderator

You might consider trying the approach described in

https://call4cloud.nl/2020/11/the-conditional-access-experiment/

More at https://techcommunity.microsoft.com/t5/microsoft-entra/block-user-access-to-azure-ad-powershell-with-conditional-access/m-p/2972411#M6945

hth

Marcin

Andy Goldberg 0 Reputation points

2024-03-15T15:31:28.7+00:00

Thanks, Marcin. I already block all apps, except for o365, but here is the problem: Conditional Access policies are always applied after successful authentication, regardless of the protocol, so you can be probed for password again and again without being blocked. Our users only need email access, but o365 come with these endless ways to auth, which are a huge security risk by design.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Share via

Is there a way to block "Microsoft Azure PowerShell" for all users?

3 answers

Your answer