r/sysadmin • u/Matt-Work2023 • 7h ago
Conditional access policies requirement
Hi,
Thanks in advance for any assistance - have a bit of a headache with the set-up.
We use Azure Virtual Desktop and currently have a Conditional Access policy that blocks access from locations outside our exempt locations, such as our office IP addresses.
We have a secondary Conditional Access policy that provides an exemption from this restriction. This policy is currently configured to block access from All locations, with a security group excluded from the policy so that members of the group are not subject to the block to facilitate travel.
We are now looking to limit this further to just the country that they are visiting.
For example, if a user is travelling to Spain and is a member of a security group such as "AVD Exclusions - Travel", we would want their exemption to apply only while they are accessing AVD from Spain.
I do not want to exclude Spain as a location, as this would allow all users to access AVD from Spain. On the other hand, the current set-up limits it to security group, so 1 user, but accessible from 'All locations'. Is this possible in a single policy?
•
u/PacificTSP 7h ago
We get around the problem by requiring domain joined and compliant devices. You still can put the user in the exempt travel group but they cant login if they arent on a company owned/managed device.
•
u/Matt-Work2023 6h ago
Hi, thanks for the response - unfortunately, they use personal mobiles for emails etc. The access is block all apps unless in the home country at the moment :|.
I think we MIGHT be able to achieve this by excluding the security group from the primary conditional access policy, then creating a new policy 'travel abroad' which is targeted just to the security group, and has the location as the country!
•
u/PacificTSP 6h ago
We use personal devices too for cellphones etc. but they are registered in intune so we can remove our data if the device is lost.
•
u/Matt-Work2023 6h ago
Thanks - I need to implement that too. Might be a good idea to bundle the two requirements
•
u/blud_13 6h ago
Get off the block All locations with an excluded group pattern, as this feels backwards. Build a named location per country you actually travel to, then one block policy scoped to the travel group that excludes your office locations plus whichever trip location is currently live. You toggle the location, not the group membership.
Also, tick Include unknown countries/regions on the block or you'll have a hole in it. Plenty of mobile carrier and cloud egress IPs resolve to nothing at all.
If IP geo is not precise enough (spoiler alert: it won't be, carriers and VPNs misclassify constantly) you can determine location by GPS instead, but every user in scope needs Authenticator on a phone, has to grant background location, and it only polls hourly. Its all in the network assignment doc here https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-assignment-network
For AVD I would sooner gate on compliant device plus strong MFA and leave country as a coarse block, otherwise every trip turns into a change request. Can go deeper if it helps.
•
•
u/-ThesuarusRex- 7h ago
Can't you do that under privileged identity management?
•
•
u/Matt-Work2023 6h ago
Thanks, unfortunately we do not have P2.
•
u/-ThesuarusRex- 6h ago
Hrm...
What about creating a powershell script to add users to your group and then remove them at a set time in the future?
•
u/JohnnyFnG 7h ago
An easier way to manage this is to ask the clients to use a request form - or an email to acknowledge travel, whatever your group sees fit - to acknowledge they are traveling, and put them in the single exclusion group. Upon their return, move them to the standard conditional access policy. Managing per country policies sounds like needless busywork to alleviate asking the clients to let you know of their travels.
However, in the event they travel to several countries - one of which you approve one of which you don’t and during the same business trip - I could see how this can be useful. Also setting these restrictions in advance means it just works.
I’d imagine you’d have to socialize an approved countries device usage policy so they are fully aware of their access capabilities. That is why the initial suggestion to request access on a per travel basis may be beneficial for a per client review and acknowledgment of what they will be allowed to use. Depending on the size of your organization, this goes from easy to unmanageable real fast.