Native Microsoft Security Stack

Conditional Access App Control & Defender for Cloud Apps

AuditionAI is built natively on Microsoft Entra ID, inside your own Azure tenant, so your organization's Microsoft Purview and Defender for Cloud Apps policies extend to AuditionAI automatically, the moment you turn them on. No integration work. No waiting on our roadmap. Just instant, admin-controlled enforcement over downloads, copy/paste, and printing.

This is one layer of AuditionAI's defense-in-depth security model. See our Azure Entra Enterprise App Integration guide for how the rest of our identity and access architecture works.

Defense in Depth, By Design

AuditionAI employs multiple layers of protection and integrates seamlessly with Microsoft's Entra and Defender stack, giving your compliance team more control, not less.

Application-Level Access

AuditionAI's own Entra Enterprise App starts with zero permissions and only ever requests the Microsoft Graph scopes your admin approves.

See how scopes work →

Identity-Level Enforcement

Microsoft Entra Conditional Access governs sign-in itself (MFA, device compliance, location, and risk-based access) before a session ever starts.

Session-Level DLP

Defender for Cloud Apps enforces real-time controls inside the browser session, blocking download, copy, paste, and print the instant your admin turns it on.

Content-Aware Classification

Microsoft Purview sensitivity labels power "download with inspection," so policy decisions react to how sensitive the content actually is, not just the action taken.

How It Works

MDCA's Conditional Access App Control delivers real-time, in-session control over browser-based access to a cloud app via two policy types, layered on top of a Microsoft Entra Conditional Access policy.

Access Policies

Allow or block access to the app entirely, for example blocking unmanaged devices outright.

Session Policies

Allow access but monitor or restrict specific in-session activities: block file download, block cut/copy/paste, block printing, or require step-up authentication when a sensitive activity occurs.

The Mechanics

A Conditional Access policy scoped to the app, with session control "Use Conditional Access App Control," routes the sign-in through MDCA.

Microsoft Edge for Business users get in-browser protection directly: no proxy, no URL rewriting.
Every other browser (Chrome, Firefox, Safari) is redirected through a reverse proxy: the app's URL is rewritten with an .mcas.ms suffix (e.g. myapp.com → myapp.com.mcas.ms), and MDCA uses heuristics against the proxied traffic/DOM to detect and block activities like download, copy, cut, paste, and print.
MDCA doesn't require installing anything on the device, so it also works for unmanaged/BYOD devices and external partner users, which is its main appeal over a device-compliance-only approach.
Conditional Access policies apply at the app level, not the file level, so a client admin can't exclude specific files.
Session policies also support "Require step-up authentication": when a matched activity occurs, MDCA redirects back to Entra Conditional Access for re-evaluation against a configured Authentication Context.

Why This Works Out of the Box

Client

Next.js SPA

Uses MSAL.js (PublicClientApplication) for interactive sign-in via OpenID Connect/OAuth2 against Microsoft Entra ID, not SAML.

Note: real-time streaming surfaces can be impacted as MDCA evolves and upgrades. AuditionAI leverages WebSocket technology, so admins should validate these surfaces after enabling session controls.

Server

ASP.NET Core

Uses Microsoft.Identity.Web's AddMicrosoftIdentityWebApi against a multi-tenant Entra app registration, validating bearer access tokens on every request.

The Important Consequence of Being an OIDC App, Not SAML

Per Microsoft's docs, Microsoft Entra ID apps are automatically onboarded for Conditional Access app control and support any interactive single sign-on that uses the OpenID Connect authentication protocol. AuditionAI's Enterprise App instance in a client's tenant does not need the SAML/non-Microsoft-IdP onboarding wizard; a client admin can select it directly as a target resource in a normal Entra Conditional Access policy. See our Azure Entra Enterprise App Integration guide for how that Enterprise App instance is provisioned per tenant.

Configuration Steps

Condensed from Microsoft's official documentation, linked throughout.

Prerequisites

Microsoft Entra ID P1 or higher (bundled in EMS E3/E5, Microsoft 365 E3/E5, or the Microsoft 365 E5 Security add-on) and a Defender for Cloud Apps license (standalone, or bundled in Microsoft 365 E5 / E5 Security).

1
Create a Conditional Access policy
In the Microsoft Entra admin center → Entra ID → Conditional Access → Policies → New policy. (Use Defender for Cloud Apps Conditional Access app control (overview))
2
Target AuditionAI's Enterprise App
Target resources → select AuditionAI's Enterprise App instance for the tenant.
3
Route the session through MDCA
Under Access controls → Session, select "Use Conditional Access App Control."
4
Stage the rollout
Save the policy in Report-only mode first, verify impact, then turn it On.
5
Create a session policy in Defender
In the Microsoft Defender portal → Cloud Apps → Policies → Policy management → Conditional Access → Create policy → Session policy. (Create session policies)
6
Set the session control type
"Control file download (with inspection)" + action Block blocks downloads, powered by Microsoft Purview sensitivity labels. "Block activities" with Activity type = Copy / Print + action Block blocks clipboard/print actions.
7
Test and verify
Confirm the .mcas.ms URL suffix appears (non-Edge browsers) or the lock icon appears (Edge for Business), and check the policy report in the Defender portal before relying on it. (In-browser protection with Microsoft Edge for Business (preview))

Caveats Worth Calling Out to a Client's Admin

Browser-Based Sessions Only

Native/desktop/mobile clients are a separate access-policy concern, and per Microsoft, the Teams desktop app specifically is not supported for these session controls at all.

AuditionAI Mobile Apps Aren't Covered Yet

If session-level DLP is a hard requirement, don't permit the AuditionAI iOS and Android apps for now: they're in enterprise preview and don't yet fully support the MDCA stack. Restrict access to the browser experience until mobile parity lands.

Don't Block MDCA's Own Session Controls App

A client's own "Block access" grant policies must not inadvertently also block the "Microsoft Defender for Cloud Apps – Session Controls" enterprise app Microsoft creates in their tenant, or session controls stop working entirely for every protected app.

Screenshots Are Always Possible

No control, from any vendor, can stop a screenshot or a phone photo of the screen. That's a universal limitation of protecting rendered content in a browser, not specific to this mechanism.

Blocks file download

Blocks cut/copy/paste

Blocks printing

Sources

Related Resources

See how AuditionAI's own Entra Enterprise App is provisioned and scoped per tenant.

Azure Entra Enterprise App Integration Guide →

For the full picture on AuditionAI's security architecture, encryption, and compliance alignment.

Security Implementation Guide →

Ready to Extend Your Compliance Policies?

Talk to our team about how AuditionAI's Azure-native architecture lets you enforce your existing Entra and Purview policies without lifting a finger.