{"action":"closed","issue":{"url":"https://api.github.com/repos/MicrosoftDocs/vsts-docs/issues/4845","repository_url":"https://api.github.com/repos/MicrosoftDocs/vsts-docs","labels_url":"https://api.github.com/repos/MicrosoftDocs/vsts-docs/issues/4845/labels{/name}","comments_url":"https://api.github.com/repos/MicrosoftDocs/vsts-docs/issues/4845/comments","events_url":"https://api.github.com/repos/MicrosoftDocs/vsts-docs/issues/4845/events","html_url":"https://github.com/MicrosoftDocs/vsts-docs/issues/4845","id":467364606,"node_id":"MDU6SXNzdWU0NjczNjQ2MDY=","number":4845,"title":"CA Policy blocking access within other Azure services","user":{"login":"rohancragg","id":104555,"node_id":"MDQ6VXNlcjEwNDU1NQ==","avatar_url":"https://avatars3.githubusercontent.com/u/104555?v=4","gravatar_id":"","url":"https://api.github.com/users/rohancragg","html_url":"https://github.com/rohancragg","followers_url":"https://api.github.com/users/rohancragg/followers","following_url":"https://api.github.com/users/rohancragg/following{/other_user}","gists_url":"https://api.github.com/users/rohancragg/gists{/gist_id}","starred_url":"https://api.github.com/users/rohancragg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rohancragg/subscriptions","organizations_url":"https://api.github.com/users/rohancragg/orgs","repos_url":"https://api.github.com/users/rohancragg/repos","events_url":"https://api.github.com/users/rohancragg/events{/privacy}","received_events_url":"https://api.github.com/users/rohancragg/received_events","type":"User","site_admin":false},"labels":[{"id":1456319287,"node_id":"MDU6TGFiZWwxNDU2MzE5Mjg3","url":"https://api.github.com/repos/MicrosoftDocs/vsts-docs/labels/Pri2","name":"Pri2","color":"ededed","default":false},{"id":1161676580,"node_id":"MDU6TGFiZWwxMTYxNjc2NTgw","url":"https://api.github.com/repos/MicrosoftDocs/vsts-docs/labels/area%20-%20organizations","name":"area - organizations","color":"23a3a8","default":false},{"id":1306035024,"node_id":"MDU6TGFiZWwxMzA2MDM1MDI0","url":"https://api.github.com/repos/MicrosoftDocs/vsts-docs/labels/devops-accounts/tech","name":"devops-accounts/tech","color":"ededed","default":false},{"id":1183479755,"node_id":"MDU6TGFiZWwxMTgzNDc5NzU1","url":"https://api.github.com/repos/MicrosoftDocs/vsts-docs/labels/devops/prod","name":"devops/prod","color":"ededed","default":false}],"state":"closed","locked":false,"assignee":{"login":"chcomley","id":35748196,"node_id":"MDQ6VXNlcjM1NzQ4MTk2","avatar_url":"https://avatars2.githubusercontent.com/u/35748196?v=4","gravatar_id":"","url":"https://api.github.com/users/chcomley","html_url":"https://github.com/chcomley","followers_url":"https://api.github.com/users/chcomley/followers","following_url":"https://api.github.com/users/chcomley/following{/other_user}","gists_url":"https://api.github.com/users/chcomley/gists{/gist_id}","starred_url":"https://api.github.com/users/chcomley/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chcomley/subscriptions","organizations_url":"https://api.github.com/users/chcomley/orgs","repos_url":"https://api.github.com/users/chcomley/repos","events_url":"https://api.github.com/users/chcomley/events{/privacy}","received_events_url":"https://api.github.com/users/chcomley/received_events","type":"User","site_admin":false},"assignees":[{"login":"chcomley","id":35748196,"node_id":"MDQ6VXNlcjM1NzQ4MTk2","avatar_url":"https://avatars2.githubusercontent.com/u/35748196?v=4","gravatar_id":"","url":"https://api.github.com/users/chcomley","html_url":"https://github.com/chcomley","followers_url":"https://api.github.com/users/chcomley/followers","following_url":"https://api.github.com/users/chcomley/following{/other_user}","gists_url":"https://api.github.com/users/chcomley/gists{/gist_id}","starred_url":"https://api.github.com/users/chcomley/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chcomley/subscriptions","organizations_url":"https://api.github.com/users/chcomley/orgs","repos_url":"https://api.github.com/users/chcomley/repos","events_url":"https://api.github.com/users/chcomley/events{/privacy}","received_events_url":"https://api.github.com/users/chcomley/received_events","type":"User","site_admin":false}],"milestone":null,"comments":4,"created_at":"2019-07-12T11:28:40Z","updated_at":"2019-07-26T19:05:33Z","closed_at":"2019-07-26T19:05:33Z","author_association":"NONE","body":"I've been discovering that a with Conditional Access policy as described here (i.e which is blocks access to 'Azure DevOps' Cloud app unless the user is coming from a Named Location).\n\nI've found that this works as expected, but that it blocks other services such as Notebook (Git) version control in Azure Databricks (https://docs.azuredatabricks.net/user-guide/notebooks/azure-devops-services-version-control.html), and is also prevents an App Service (in this case a Function App) from performing a Git sync.\n\nI have found what I hope are appropriate work-arounds (below) which may be useful to document here?\n\n---\nWorkarounds\n---\n\nI have discovered that if I can identify IP addresses of the Databricks Control Plane NAT (https://docs.azuredatabricks.net/administration-guide/cloud-configurations/azure/udr.html#control-plane-nat-and-webapp-ip-addresses) and add those into the CA Policy as another Named Location to be excluded then this fixes the issue.\n\nSimilarly, for App Services, I can fix the problem by adding the outbound IP addresses of the App Service Resource (obtained as follows:   \nhttps://docs.microsoft.com/en-us/azure/app-service/overview-inbound-outbound-ips)\n\n---\n#### Document Details\n\n⚠ *Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.*\n\n* ID: 24bd6400-4207-6f85-8a4e-5c9b0cc99cff\n* Version Independent ID: 0b018039-29d1-431a-1be9-4b46af7f084f\n* Content: [Manage conditional access policies - Azure DevOps Services](https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/manage-conditional-access?view=azure-devops)\n* Content Source: [docs/organizations/accounts/manage-conditional-access.md](https://github.com/MicrosoftDocs/vsts-docs/blob/master/docs/organizations/accounts/manage-conditional-access.md)\n* Product: **devops**\n* Technology: **devops-accounts**\n* GitHub Login: @chcomley\n* Microsoft Alias: **chcomley**"}}
{"actor":{"display_login":"chcomley"}}