No alternative way to tighten security if whitelisting urls is the only solution.

[glr0221]

Article URL
On what page did you find the problem?
https://learn.microsoft.com/en-us/azure/azure-portal/azure-portal-safelist-urls?tabs=public-cloud&source=docs

Describe the problem
The document does not provide a way for admins to allow addins to communicate with login.microsoftonline.com. So imagine a case where an admin whitelists login.microsoftonline.com in the proxy server which effectively means that anybody within the organization will now be allowed to access the said url. One of our cases has the following issue :

We are against whitelisting this domain because doing so would lessen our security controls. For example, we have one policy on the proxy that prevents users from being able to login to other O365 tenants that they may be guests of. For this control to be in place, we must perform SSL inspection on domains like login.microsoft.com, which cannot be done if we are whitelisting (bypassing) the domains.

Does Microsoft have any recommendation/documentation that can help us allow addins to access login.microsoftonline.com without having to whitelist the url? Moreover, if whitelisting is the only way, how can an admin limit users from being able to login to other O365 tenants that they may be guests of? Can whitelisting be done based on the app/client ID of the addin?

I don't know if this is the right venue for this question but raised it here anyways. Thank you very much for your support and understanding.

[davidchesnut]

Hi @glr0221,

I don't know that you have to whitelist that domain. it's recommended. In this case it looks like they just inspect the requests to login.microsoftonline.com to ensure the calls are for their own tenant. Add-ins typically are requesting access tokens on behalf of the user, so I would think your requests would comply with their SSL policy. Do you have any additional information on what causes your add-in requests to get blocked? If the user can sign in to Microsoft 365, then it seems like your add-in should be able to work since both actions use the same domain.

Thanks!
David

[microsoft-github-policy-service]

This issue has been automatically marked as stale because it is marked as needing author feedback but has not had any activity for 4 days. It will be closed if no further activity occurs within 3 days of this comment. Thank you for your interest in Office Add-ins!

[microsoft-github-policy-service]

This issue has been closed due to inactivity. Please comment if you still need assistance and we'll re-open the issue.