Conditional access policies for country blocking

[Sheridan]

I've inherited an Azure tenant, and one thing I've just noticed is is has conditional access policies to block access outside the UK, and then specific Allow policies to allow some Staff access from various European countries (school trips etc)

 

But it appears this isn't working - I can see in the Sign in logs MFA is satisfied, then the rule to block access outside the UK is a result of 'Failure' and the rule to allow access from Italy/France is simply not applied - even though the log shows access is attempted from that country! The user sees a message saying access is blocked. When I run the diagnostics it shows the 'Outside UK' rule has been applied, and suggests adding an allow rule for that country, which is already in place

 

So do these location rules actually work? It seems like they're just ignored during sign in

[PotNoodleTech]

You'll have to pop to some European countries to test it!!

[NegativeKillDeath]

Is the allow rule a separate CA policy? I think you may have to exclude the users from the deny policy and have them only in the policy that allows certain countries. The 'allow' policy should also block access but have exception for the countries you want.

[CHiLL]

Is the allow rule a separate CA policy? I think you may have to exclude the users from the deny policy and have them only in the policy that allows certain countries. The 'allow' policy should also block access but have exception for the countries you want.

This is basically what I was going to suggest, have your location exclusions in one policy. For example, in your "Deny logins from outside UK" policy, check the "Network" section and under "Include", select "Any network or location". On the "Exclude" tab, select the UK and other locations you want to allow logins from.

[Sheridan]

Yes, its a blank CA policy to deny, then separate policies for each country to Allow - but they seem to be overlooked so I'll have to just add the users into the Excluded part of the main rule

[chaplic]

It’s not in an order, or a specific allow beats a generic deny, the most restrictive policy applies.

[HPlum78]

As I cannot see the rules I would not be able to offer any real insights in to how your CA policies are working/ not working but here is some useful information:

 

https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-policy-location

https://learn.microsoft.com/en-us/security/zero-trust/zero-trust-identity-device-access-policies-common?view=o365-worldwide#assigning-policies-to-groups-and-users

https://practical365.com/five-most-common-conditional-access-misconfigurations/

https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-insights-reporting

 

The one thing I would absolutely make sure you have is a CAP exemption group with your brake glass accounts in, and added as an exemption to all of your CA policies so you dont lock yourself out of your Tenant!

Edited July 11, 2024 by HPlum78

[TechMonkey]

This is basically what I was going to suggest, have your location exclusions in one policy. For example, in your "Deny logins from outside UK" policy, check the "Network" section and under "Include", select "Any network or location". On the "Exclude" tab, select the UK and other locations you want to allow logins from.

 

To make it simpler you can create an allowed countries list and just applied that as the exclude option.

[Sheridan]

Thanks all, I think this needs a tidy up - basically theres a rule to block access from outside the UK applied to all staff/students. Then there are multiple rules to allow specific staff access from various countries, so obviously this has been added piecemeal over time. So one rule allows access to 3 staff from the USA, another allows access to 2 staff from Portugal and so on, so this probably hasn't ever worked with the Outside the UK block being more restrictive!

 

I think my best option is to have a single rule, block access outside the UK (with GA accounts/admin accounts as exceptions!) and then put users into an exception group as well - keeps it simpler