你当前正在访问 Microsoft Azure Global Edition 技术文档网站。如果需要访问由世纪互联运营的 Microsoft Azure 中国技术文档网站，请访问 https://docs.azure.cn。

New-AzureADMSConditionalAccessPolicy

参考

模块:: AzureADPreview

在 Azure Active Directory 中创建新的条件访问策略。

语法

New-AzureADMSConditionalAccessPolicy
   [-Id <String>]
   [-DisplayName <String>]
   [-State <String>]
   [-Conditions <ConditionalAccessConditionSet>]
   [-GrantControls <ConditionalAccessGrantControls>]
   [-SessionControls <ConditionalAccessSessionControls>]
   [<CommonParameters>]

说明

此 cmdlet 允许管理员在 Azure Active Directory 中创建新的条件访问策略。条件访问策略是定义访问方案的自定义规则。

示例

示例 1：在 Azure AD 中创建要求 MFA 访问 Exchange Online 的新条件访问策略

PS C:\> $conditions = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessConditionSet
PS C:\> $conditions.Applications = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessApplicationCondition
PS C:\> $conditions.Applications.IncludeApplications = "00000002-0000-0ff1-ce00-000000000000"
PS C:\> $conditions.Users = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessUserCondition
PS C:\> $conditions.Users.IncludeUsers = "all"
PS C:\> $controls = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessGrantControls
PS C:\> $controls._Operator = "OR"
PS C:\> $controls.BuiltInControls = "mfa"
PS C:\> New-AzureADMSConditionalAccessPolicy -DisplayName "MFA policy" -State "Enabled" -Conditions $conditions -GrantControls $controls

Id                      : 6b5e999b-0ba8-4186-a106-e0296c1c4358
DisplayName             : MFA policy
CreatedDateTime         : 2019-09-26T23:12:16.0792706Z
ModifiedDateTime        : 2019-09-27T00:12:12.5986473Z
State                   : Enabled

此命令在 Azure AD 中创建新的条件访问策略，该策略要求 MFA 访问 Exchange Online。

示例 2：在 Azure AD 中创建新的条件访问策略，阻止从不受信任的区域访问 Exchange Online

PS C:\> $conditions = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessConditionSet
PS C:\> $conditions.Applications = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessApplicationCondition
PS C:\> $conditions.Applications.IncludeApplications = "00000002-0000-0ff1-ce00-000000000000"
PS C:\> $conditions.Users = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessUserCondition
PS C:\> $conditions.Users.IncludeUsers = "all"
PS C:\> $conditions.Locations = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessLocationCondition
PS C:\> $conditions.Locations.IncludeLocations = "198ad66e-87b3-4157-85a3-8a7b51794ee9"
PS C:\> $controls = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessGrantControls
PS C:\> $controls._Operator = "OR"
PS C:\> $controls.BuiltInControls = "block"
PS C:\> New-AzureADMSConditionalAccessPolicy -DisplayName "MFA policy" -State "Enabled" -Conditions $conditions -GrantControls $controls

Id                      : 6b5e999b-0ba8-4186-a106-e0296c1c4358
DisplayName             : MFA policy
CreatedDateTime         : 2019-09-26T23:12:16.0792706Z
ModifiedDateTime        : 2019-09-27T00:12:12.5986473Z
State                   : Enabled

示例 3：在 Azure AD 中创建新的条件访问策略，阻止从不合规的设备访问 Exchange Online

PS C:\> $conditions = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessConditionSet
PS C:\> $conditions.Applications = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessApplicationCondition
PS C:\> $conditions.Applications.IncludeApplications = "00000002-0000-0ff1-ce00-000000000000"
PS C:\> $conditions.Users = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessUserCondition
PS C:\> $conditions.Users.IncludeUsers = "all"
PS C:\> $conditions.Devices = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessDevicesCondition
PS C:\> $conditions.Devices.DeviceFilter = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessFilter
PS C:\> $conditions.Devices.DeviceFilter.Mode = "exclude"
PS C:\> $conditions.Devices.DeviceFilter.Rule = "device.isCompliant -eq True"
PS C:\> $controls = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessGrantControls
PS C:\> $controls._Operator = "OR"
PS C:\> $controls.BuiltInControls = "block"
PS C:\> New-AzureADMSConditionalAccessPolicy -DisplayName "Block Non-compliant device policy" -State "Enabled" -Conditions $conditions -GrantControls $controls

Id               : c5560f6b-2931-4b40-8e94-8b9e11a507c1
DisplayName      : Block Non-compliant device policy
CreatedDateTime  : 2022-04-20T15:15:41.9500079Z
ModifiedDateTime : 
State            : enabled

此命令在 Azure AD 中创建一个新的条件访问策略，用于阻止从不受信任的区域访问 Exchange Online。它演示了设备条件筛选器的用法。

参数

-Conditions

指定 Azure Active Directory 中条件访问策略的条件。

类型:	ConditionalAccessConditionSet
Position:	Named
默认值:	None
必需:	False
接受管道输入:	False
接受通配符:	False

-DisplayName

指定 Azure Active Directory 中条件访问策略的显示名称。

类型:	String
Position:	Named
默认值:	None
必需:	False
接受管道输入:	False
接受通配符:	False

-GrantControls

指定 Azure Active Directory 中条件访问策略的控制。

类型:	ConditionalAccessGrantControls
Position:	Named
默认值:	None
必需:	False
接受管道输入:	False
接受通配符:	False

-Id

类型:	String
Position:	Named
默认值:	None
必需:	False
接受管道输入:	False
接受通配符:	False

-SessionControls

类型:	ConditionalAccessSessionControls
Position:	Named
默认值:	None
必需:	False
接受管道输入:	False
接受通配符:	False

-State

指定 Azure Active Directory 中条件访问策略的启用或禁用状态。

类型:	String
Position:	Named
默认值:	None
必需:	False
接受管道输入:	False
接受通配符:	False

通过