# SC-300 - Lab 16 - 20
# Lab 16 - Using Azure Key Vault for Managed Identities
# Lab 17 - Defender for Cloud Apps application discovery and enforcing restrictions
**Microsoft Defender for Cloud Apps** uses network traffic logs to identify which applications users are accessing. Logs from on-premises firewalls provide a snapshot of the most commonly used applications and the users interacting with them. Traffic from managed devices is also sent to the **Defender for Cloud Apps Discovery Overview Dashboard**, offering centralized visibility into app usage.
1. For defender for cloud apps discovery sign in to security.microsoft.com using global administrator account > Cloud Apps > Cloud App Catalog >and in brows by category select Cloud Storage> and in the list of apps note the Risk score next to the app name.
2. Open dropbox on another browser and you can open it
3. Return to the Defender for Cloud Apps screen, and select the three-dot to the right of Dropbox and choose **Unsanctioned** and then the **Next** button .
4. After 5 mins try to open dropbox and you can see you cannot open dropbox anymore
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744242513810/a0393851-4627-4889-86e6-ac542868a480.png align="center")
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744242541675/1583901c-8064-40df-a2a4-bd9a7a9b2d22.png align="center")
> it only applys on any client device that is onboarded to **Microsoft Defender for Endpoint (MDE)** and integrated with **Microsoft Defender for Cloud Apps**.
Questions that remained unanswered for this lab
1. How to check if we have MDE licenses on azure (What are the options)
2. How to enable MDE licenses
---
# 18 - Defender for Cloud Apps Access and Session Policies
### Login type = Microsoft 365 admin
**Exercise 1 - Create and test the Conditional Access App Contol policy**
1. First ask user to login to forms.microsoft.com, the user should have unconditional access to Forms then configure Entra ID to work with Defender for Cloud Apps
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744303338241/388cc2a1-a23f-4344-9d05-1cd463aca2e1.png align="center")
2. Navigate to Entra ID > Identity > Protection > Conditional Access > Create new policy > Enter policy name: “Monitor the user using Forms“ > select the user > add Microsoft Forms on target resources> under Access Control select Session and select use conditional access app control and leave the default of Monitor only selected and then enable the policy
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744303928426/4a5d1c84-1f5b-4cc2-a3fc-dd685acf79a0.png align="center")
3. Ask the user to login to forms.microsoft.com again, user will get a pop up message “Your company is monitoring the usage of this application.“
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744303051940/0ed6b971-bef6-422a-bd34-95937c83ae71.png align="center")
**Exercise 2 - Setup alerts in Microsoft Defender for Cloud Apps**
Task 1 - Access Microsoft Defender for Cloud Apps(security.microsoft.com) and create Conditional Access App Control
> Registering your application creates a trust relationship with the Microsoft identity platform. This trust is one-way—your app trusts the Microsoft identity platform, but not vice versa.
Navigate to **Microsoft Defender for Cloud Apps** via [https://security.microsoft.com](https://security.microsoft.com) using a **Global Administrator** account.
1. Go to **Cloud Apps** > **Policies** > **Policy Management** > **\+ Create policy** > Select **Access policy**. Enter policy name: **“Monitor Microsoft Forms access”** and Leave **Category** as **Access control**.
2. Under **Activities matching all of the following**, open the filter for **Intune compliant, Microsoft Entra Hybrid joined**, and unselect **Microsoft Entra Hybrid joined**. Also choose **select apps** > Choose **Microsoft Forms**. Leave **Actions** set to **Test**.
3. Under **Alerts**, leave **Create an alert…** checked and select **Send alert as email**. Enter the **lab admin email address**, then press **Enter**. Click **Create** to finalize the access policy.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744309783506/2b6bba6e-c082-4d65-a8fd-1dad9e5db9fd.png align="center")
4. Now if user logs in to the forms.microsoft.com again he will get this message
> Your company is monitoring the usage of this application.
5. Return to the browser running **Defender for Cloud Apps** and **refresh the page** then navigate to **Investigate** > **Activity log** and use the **App filter** to select **Microsoft Forms**. Review the **sign-in records** of the user.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744310615765/c9a38ee2-3c3f-4375-95fd-de2da74f2c78.png align="center")
---
# Lab 19 - Register an application
### Login type = Microsoft 365 admin
### Exercise 1 - Register an application
Task 1 - App registration:
1. **Entra ID**\> **Identity > Applications > App registrations** > **\+ New registration**.
Enter the application name: **Demo app**. Leave all other fields as default (Redirect URI not required).
Click **Register**.
![Screen image displaying the Register an application page with the name and default settings highlighted](https://github.com/MicrosoftLearning/SC-300-Identity-and-Access-Administrator/raw/master/Instructions/Labs/media/lp3-mod3-register-an-application.png align="left")
Task 2 - Configure platform settings
Settings for each application type, including redirect URIs, are configured in **Platform configurations** in the Azure portal. Some platforms, like **Web** and **Single-page applications**, require you to manually specify a redirect URI. For other platforms, like mobile and desktop, you can select from redirect URIs generated for you when you configure their other settings.
2. **Entra ID** \> **Identity** > **Application** > **App registrations** \> Select your application > **Manage** > select **Authentication** > **Platform configurations** > **\+ Add a platform** > Select **Web** as the platform > In **Redirect URI**, enter: [https://localhost](https://localhost) > Click **Configure** to save the platform settings.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744654153960/ce40bddf-a59b-4602-97f6-ad6ab36a4283.png align="center")
| Platform | Configuration settings |
| --- | --- |
| Web | Enter a **Redirect URI** for your app, the location where Microsoft identity platform redirects a user's client and sends security tokens after authentication. Select this platform for standard web applications that run on a server. |
| Single-page application | Enter a **Redirect URI** for your app, the location where Microsoft identity platform redirects a user's client and sends security tokens after authentication. Select this platform if you're building a client-side web app in JavaScript or with a framework like Angular, Vue.js, React.js, or Blazor WebAssembly. |
| iOS/macOS | Enter the app **Bundle ID**, found in XCode in *Info.plist* or Build Settings. A redirect URI is generated for you when you specify a Bundle ID. |
| Android | Enter the app **Package name**, which you can find in the AndroidManifest.xml file, and generate and enter the **Signature hash**. A redirect URI is generated for you when you specify these settings. |
| Mobile and desktop applications | Select one of the **Suggested redirect URIs** or specify a **Custom redirect URI**. For desktop applications, we recommend: [https://login.microsoftonline.com/common/oauth2/nativeclient](https://login.microsoftonline.com/common/oauth2/nativeclient). Select this platform for mobile applications that aren't using the latest Microsoft Authentication Library (MSAL) or are not using a broker. Also select this platform for desktop applications. |
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744654370993/f39e54d0-56a6-46f3-acdc-6c4eb705a8ba.png align="center")
Task 3 - Add credentials, certificate and client secret
Credentials are used by confidential client applications that access a web API. Examples of confidential clients include web apps, other web APIs, and service-type and daemon-type applications. Credentials allow your application to authenticate as itself, requiring no interaction from a user at runtime.
You can add both certificates and client secrets (a string) as credentials to your confidential client app registration.
> **Note**: Sometimes called a *public key*, certificates are the recommended credential type, because as they provide a higher level of assurance than a client secret. When using a trusted public certificate, you can add the certificate using the Certificates & secrets feature. Your certificate must be one of the following file types: .cer, .pem, .crt.
> **Note**: The client secret, also known as an *application password*, is a string value your app can use in place of a certificate to identity itself. It's the easier of the two credential types to use. It's often used during development, but is considered less secure than a certificate. You should use certificates in your applications running in production.
3. **Azure portal** > **App registrations >** Select **your application >** Select **Certificates & secrets** > Click **\+ New client secret**. > **Enter description: SC300 lab secret >** Set duration: 90 days (3 months) > Click **Add**\> **Save the secret's value in notepad** for use in your client application code; The Certificate & Secrets page will display the new secret value. It's important you copy this value as it's only shown this one time; if you refresh your page and come back, it will only show as a masked value.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744659278645/b48bf5b8-b7b4-4041-bd12-185608a9d938.png align="center")
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744659426028/d70e6216-ae41-4193-98bf-7f6fe4d06079.png align="center")
With your web App registered, you're ready to add the scopes that your API's code can use to provide granular permission to consumers of your API.
Task 5 - Add a scope
The code in a client application requests permission to perform operations defined by your web API by passing an access token along with its requests to the protected resource (the web API). Your web API then performs the requested operation only if the access token it receives contains the scopes (also known as application permissions) required for the operation.
First, follow these steps to create an example scope named [Employees.Read](http://Employees.Read).All:
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744661750967/046a4adf-d425-4973-a882-b4c659a19ebc.png align="center")
5. **Applications > App registrations** > Select your API’s app registration.
Select **Expose an API** > Click **\+ Add a scope**\> Set the **Application ID URI** to: api://DemoAppAPI > Click **Save and continue** > In **Add a scope**, fill in the scope details (use “Value” column info in the table below) > Set **State** to **Enabled** > Click **Add scope**.
| Field | Description | Value |
| --- | --- | --- |
| Scope name | The name of your scope. A common scope naming convention is resource.operation.constraint. | [Employees.Read](http://Employees.Read).All |
| Who can consent | Whether this scope can be consented to by users or if admin consent is required. Select Admins only for higher-privileged permissions. | Admins and users |
| Admin consent display name | A short description of the scope's purpose that only admins will see. | Read-only access to employee records |
| Admin consent description | A more detailed description of the permission granted by the scope that only admins will see. | Allow the application to have read-only access to all employee data. |
| User consent display name | A short description of the scope's purpose. Shown to users only if you set Who can consent to Admins and users. | Read-only access to your employee records |
| User consent description | A more detailed description of the permission granted by the scope. Shown to users only if you set Who can consent to Admins and users. | Allow the application to have read-only access to your employee data. |
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744663598172/6c9c3dcd-0a9f-459c-ab73-b9116322d65a.png align="center")
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744665112909/f8ad655d-f0fe-41a1-ad7c-5219059ecd9c.png align="center")
> Note - The App ID URI acts as the prefix for the scopes you'll reference in your API's code, and it must be globally unique. You can use the default value provided, which is in the form api://<application-client-id>, or specify a more readable URI like [`https://contoso.com/api`](https://contoso.com/api).
(Optional) To suppress prompting for consent by users of your app to the scopes you've defined, you can *pre-authorize* the client application to access your web API. Pre-authorize *only* those client applications you trust since your users won't have the opportunity to decline consent.
Under **Exposed an API** > **Authorized client applications** \> click **Add a client application**\> Enter the **Application (client) ID** of the trusted client app (you can dind app id on overview tab) > Select the authorized scopes checkmark > Click **Add application**.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744665564632/7cab04b3-2bfa-4d8f-bbdf-c076df111e7e.png align="center")
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744665609297/2e688e0b-1d07-4a16-87d3-4347c9336c08.png align="center")
If you followed this optional step, the client app is now a pre-authorized client app (PCA), and users won't be prompted for their consent when signing into it.
Task 6 - Add a scope requiring admin consent
Next, add another example scope named Employees.Write.All that only admins can consent to. Scopes that require admin consent are typically used for providing access to higher-privileged operations, often by client applications that run as backend services or daemons that don't sign in a user interactively.
6. Follow the above steps to add a new scope named Employee.Write.All, enable it, and click **Add scope** to save.
| Field | Example value |
| --- | --- |
| Scope name | Employees.Write.All |
| Who can consent | Admins only |
| Admin consent display name | Write access to employee records |
| Admin consent description | Allow the application to have write access to all employee data. |
| User consent display name | None (leave empty) |
| User consent description | None (leave empty) |
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744669299872/27af1370-7728-40a8-bf90-0c0ec6c3c5f6.png align="center")
As shown in the image, a scope's full string is the concatenation of your web API's **Application ID URI** and the scope's **Scope name**.
**Note**: For example, if your web API's application ID URI is [`https://contoso.com/api`](https://contoso.com/api) and the scope name is [Employees.Read](http://Employees.Read).All, the full scope is: [`https://contoso.com/api/Employees.Read.All`](https://contoso.com/api/Employees.Read.All)
**Note**: Next, you will configure a client app's registration with access to your web API and the scopes you defined by following the steps above. Once a client app registration is granted permission to access your web API, the client can be issued an OAuth 2.0 access token by the Microsoft identity platform. When the client calls the web API, it presents an access token whose scope (scp) claim is set to the permissions you've specified in the client's app registration. You can expose additional scopes later as necessary. Consider that your web API can expose multiple scopes associated with several operations. Your resource can control access to the web API at runtime by evaluating the scope (scp) claim(s) in the OAuth 2.0 access token it receives.
### Exercise 2 - Manage app registration with a custom role
Task 1 - Create a new custom role to grant access to manage app registrations
1. **Entra ID** > **Identity > Roles and admins** > **\+ New custom role** > **Basics** tab > enter the role name: My custom app role > Click **Next** > **Permissions** tab > search for credentials > Select **Manage permissions** from the results > Click **Next** twice > Review the settings and click **Create**.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744673603869/c14aef80-d54b-44d6-a9b1-febda44e7009.png align="center")
> [microsoft.directory/servicePrincipals/managePasswordSingleSignOnCredentials](http://microsoft.directory/servicePrincipals/managePasswordSingleSignOnCredentials) - Manage password single sign-on credentials or service principals. [microsoft.directory/servicePrincipals/synchronizationCredentials/manage](http://microsoft.directory/servicePrincipals/synchronizationCredentials/manage) - Manage application provisioning secrets and credentials.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744673739984/3f967045-485f-493b-88d5-3de2886ebab5.png align="center")
**Why pick those two** - For application provisionsing these two items are the bare minimum permissions needed to enable and enforce single sign-on for the application or service principal being created; and be able to assign the enterise application to a set of users or groups. Other permissions could also be granted. You can get a full list of available permissions at [`https://docs.microsoft.com/azure/active-directory/roles/custom-enterprise-app-permissions`](https://docs.microsoft.com/azure/active-directory/roles/custom-enterprise-app-permissions).
---
# Lab 20 - Implement access management for apps
### Login type = Microsoft 365 admin
Your organization requires that only specific users or groups have access to enterprise applications. You must assign a user to a specific application.
#### Task 1 - Add an app to your Microsoft Entra tenant
1. **Identity > Applications > Enterprise applications** > **\+ New application** > **Browse Microsoft Entra Gallery** page > search for GitHub > Select **GitHub Enterprise Cloud – Enterprise Account** from the results > Review the settings and click **Create**.
(Once created, you’ll be redirected to the **GitHub Enterprise Cloud – Enterprise Account** page.)
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744674658030/1eadf26c-ed12-40ae-b993-9ff7204adb32.png align="center")
#### Task 2 - Assign users to an app
2. On the **GitHub Enterprise Cloud – Enterprise Account** page, go to **Overview > Getting Started > 1. Assign users and groups(** *Or*, go to **Manage > Users and groups** in the left menu.) > Click **\+ Add user/group**.
In the **Add Assignment** page, click **None selected** under **Users and groups**.
Select **Adele Vance** and your **MOD administrator account** > Click **Select** >Select Assign
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744674743736/211f3336-d4d0-4444-afbd-59e2eba6364d.png align="center")
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744674846648/fa6d6b3c-a5c4-4e53-a6ab-968bc950c712.png align="center")
![Screen image displaying adding a user account assignment to an app with the Select button highlighted ](https://github.com/MicrosoftLearning/SC-300-Identity-and-Access-Administrator/raw/master/Instructions/Labs/media/lp3-mod1-add-app-assignment.png align="left")