---
title: "How to Enforce Conditional Access using SCEP"
slug: "how-to-enforce-conditional-access-using-scep"
updated: 2025-02-01T17:48:43Z
published: 2025-02-01T17:48:43Z
canonical: "support.kandji.io/how-to-enforce-conditional-access-using-scep"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.kandji.io/kb/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Enforce Conditional Access using SCEP

> [!WARNING]
> While this method of enforcing conditional access remains effective, using Microsoft Device Compliance (MSDC) is now the recommended approach for ensuring device compliance. Please see our [MSDC configuration support articles](/v1/docs/getting-started-with-microsoft-device-compliance) for more information.

### Prerequisites

- Microsoft Entra ID (formerly Azure AD) (P1 or P2) subscription plan with Conditional Access included. See [here](https://www.microsoft.com/en-us/security/business/identity-access/azure-active-directory-pricing?rtc=1) for Microsoft Entra ID licensing information.
- Licensing for Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security). See [here](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2NXYO) for Microsoft Defender for Cloud Apps licensing information.
- For the configuration of Microsoft Entra ID and Microsoft Defender for Cloud Apps, an account with the Global Administrator role or Security Administrator role will be needed.
- Trusted Root and Intermediate certificates (PEM file).
- Managed PKI solution.

> [!NOTE]
> When using HTTP or DNS filtering, Microsoft's IP addresses will need to be added to the allow list. The IP addresses can be obtained from [this Microsoft article](https://learn.microsoft.com/en-us/defender-cloud-apps/network-requirements).

### Configure SCEP

The SCEP Library Item can be used with a Managed PKI solution such as Symantec Managed PKI, GlobalSign Managed PKI, Microsoft Entra application proxy with NDES, or SecureW2 for certificate distribution.

1. Configure and deploy a SCEP profile using the SCEP Library Item. For instructions, please refer to the [SCEP Profile](/v1/docs/scep-profile) support article.

### Deploy Root and Intermediate Certificates

1. Deploy the Root and Intermediate certificates that will be issuing the device certificates. For instructions, please refer to the [Certificate Profile](/v1/docs/certificate-profile) support article.

### Create a Conditional Access Policy

1. Click [here](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ConditionalAccessBlade/Policies) to go to the Conditional Access blade (you will be prompted to sign in if not already signed in) in Microsoft Entra ID (formerly Azure AD).
2. At the top of the Conditional Access blade, click **+ Create new policy.**![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/fibniwn3rmf9ebbx9fngxryde5qaa4jw5a.png)
3. In the Name field, enter a name for the Conditional Access policy, such as *Kandji Conditional Access*.
4. In the Assignments section, under **Users**, click on **0 users and groups selected.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/xys7s7_ghw9jr9i6ddlxt3zhq7cqjjemcw.png)**
5. While testing and validating configurations and workflows, it is recommended to assign this policy to test user accounts before assigning it to production users. To do so, select the **Select users and groups** radio button.
6. Select the **Users and groups** checkbox.
7. Navigate to the upper right corner of the screen and search for the user accounts or groups to which you want to apply the policy.
8. Select the identified user accounts or groups.
9. To save the configuration, click on **Select**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/_yjjrdh-judm1yedxav_cmqshgnojfnqew.png)
10. In the Assignments section, under **Target resources**, click on the **No target resources selected** link.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/bdc5enir37fr-snldfgrjcnpqauajz5j3a.png)
11. Select the **All cloud apps** radio button. Alternatively, you can select the **Select apps** radio button to narrow the scope to specific apps.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/3omdb4wovnyoqer05ikurjxqia9vt5uozg.png)
12. In the **Access controls** section, under **Session**, click on **0 controls selected.**
13. Select **Use Conditional Access App Control**.
14. Under the **Use Conditional Access App Control** section, select **Block downloads (Preview)** from the dropdown menu. We will return to this setting later; the **Block downloads (Preview)** option is required initially to onboard and add the scoped apps in the Microsoft Defender portal.
15. To save the configuration, click **Select**.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/2g7ijggzewhpqsuk7mp36zfhtq7z6w7meq.png)
16. Under the **Enable policy** section, switch the policy to **On**. If prompted, go through the steps to disable Microsoft **security defaults.**
17. Click **Create** to save the policy. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/fqrma5cf6yogzxdyjbnvtkqchsxjwypxga.png)

### Add the Scoped Cloud Apps to MDCA

Microsoft Defender for Cloud Apps (MDCA) uses Session Control, so to add the scoped apps to the Microsoft Defender portal, you will need to access each scoped cloud app with a test user account at least once, preferably in a private window session (⇧-⌘-N) if using Safari. We will be adding the Office 365 app in the following steps. The same process can be used to add additional apps to the Microsoft Defender portal.

1. On another device or in a private window, navigate to [portal.office.com](https://portal.office.com) and sign in with a scoped test user account.
2. To confirm the cloud app was added to MDCA, navigate to [security.microsoft.com](https://security.microsoft.com/) and sign in with an administrative account or an account with the Security role assigned to it.
3. In the bottom left corner of the page, click the **Settings** gear icon.
4. On the settings page, click **Cloud Apps.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/64b7sjy9vef8zuknirourygo6wulfmaimg.png)**
5. Under Connected apps > Click **Conditional Access App Control apps**
6. You should see Office Portal - General listed as a Connected app. If it is not, review your steps in the previous section. *It may take a bit for the Office Portal to show a connected status. Check back later to see if the status gets updated.*![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/7_zybtth7xr0vg-qfqqqunsoo9jwqpye0q.png)
7. Click [here](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ConditionalAccessBlade/Policies) to navigate back to the Conditional Access blade and select the Conditional Access policy created earlier.
8. Under **Access controls** > **Session**, click **Use Conditional Access App Control**.
9. Change the **Conditional Access App Control** setting from **Block downloads (Preview)** to **Use Custom Policy**.
10. Click **Select**.
11. Click **Save**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/pqmegkdbrxuvgffe3wirqhpt2aphbsyffa.png)

### Add your Root and Intermediate Certificates to MDCA

1. Navigate back to [security.microsoft.com](http://security.microsoft.com), and in the bottom left corner of the page, click the **Settings** gear icon.
2. On the settings page, click **Cloud Apps**.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/oifqseawtgspoahf4hym1qa1pyofbzywfg.png)
3. Scroll to the bottom of the page. Under the **Conditional Access App Control** section, click **Device identification**.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/a4g36yktc3uw1tnwti5wmtoudx1d76xdea.png)
4. Under the **Client certificate based identification** section, click **+ Add a root certificate** and follow the prompts to add your Root certificate. Repeat this process to add your Intermediate certificate.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/2jn2kso6xpzvjpn9ksxu7nhuknzgmv0xrg.png)
5. Select the **Require certificate revocation check** checkbox.
6. Click **Save**.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/j62z586gsf-96dkobbfu5aga1hqnfoeo8q.png)

To convert a CER to PEM use the following command in Terminal as an example:

```bash
openssl x509 -in certificate.cer -outform pem -out certificate.pem
```

### Create an Access Policy in MDCA

1. In the Microsoft Defender portal, in the Cloud apps section on the left-hand side navigation bar, click **Policies** > **Policy Management**.
2. Click **+ Create policy.**
3. Click **Access policy.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/zcwp5ox8zcj5b1e-bybakwow-pd1nyc5-q.png)**
4. In the name field, enter a name for the Access policy, such as *Block untrusted devices*.
5. Under the **Activities matching all of the following** section, add the following filters to block untrusted devices from accessing O365 via browsers and mobile/desktop apps:
  1. **Device Tag** does not equal **Valid client certificate**
  2. **App** equals **Office Portal** (or other scoped app)
  3. **Client app** equals **Browser, Mobile and Desktop**![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/bfm1kqhq5d_ldi2ux8lnkib4mbz4ewlmua.png)
6. Under the Actions section, select the **Block** radio button.
7. Select the **Customize block message** checkbox to enter a customized message that should be displayed to end users trying to access Microsoft 365 from untrusted devices.
8. Click **Create** to save the Access policy.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/kvzlzkbdtj7jyilgprkq4sylbhcddszyzw.png)

### End User Experience

#### Trusted Devices

End users accessing Microsoft resources on a trusted device will be prompted to select the certificate to present to Microsoft. Sample prompt when using Safari:

![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/1u11EmYKBarYKUAbfPCJpi_0qEckiMBNXg.png)

#### Untrusted Devices

End users trying to access Microsoft resources on untrusted devices will receive the following block message.

![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/ml0XAIj_IVVQ96TXgz3G0QB7q_-Q7F7IGw.png)