Do you use Conditional Access policies?

Did you know that you can stop your users from logging into any of your Azure or Office365 resources based on the location they are in? What about the types of devices that they can connect from or only allowing connections that use MFA? These things are all possible to restrict.

This seriously limits the attack surface and also helps to stop compromised devices and accounts from being used.

locationsbadexample — Figure: Bad example - No locations setup

Configure locations

First you need to add any locations that you require for your office.

Go to https://endpoint.microsoft.com | Endpoint security | Conditional Access | Named locations
Click + Countries location and add required countries

Figure: Add a location
Add as many as you require for your users to access

Figure: Every location that your users work from

Configure policies

Now configure some policies to implement these rules

Go to https://endpoint.microsoft.com | Endpoint security | Conditional Access | Policies
Select New policy | Create new policy

Figure: Add a conditional access policy
Give it a name then select Cloud apps or actions | Select All cloud apps

Figure: Add all cloud apps
Select Conditions | Locations Then set configure to yes and Include to "Any location"

Figure: Choose any location
On Exclude choose Selected locations and then exclude your workers countries (i.e. Australia)

Note: This must be done this way as the user must not meet a block access rule ever if they are to login.

conditionalaccess5 — Figure: Exclude good locations

Now select block access for this rule

Figure: Block access

Create a grant rule

Similarly create a rule that applies to all cloud apps as above
This will be exactly the same as the above rule except that you should not have conditions and should Grant access with MFA

Figure: Add a grant with MFA
You will notice that each of these rules have a 'Report only' mode or enforce. You should leave it on report mode and monitor the audit logs.

Check for any failures and only apply the rules to a small subset of your users before changing them to 'On'. This is very important as you can stop everyone including yourself from logging in.

Figure: Choose report only until you are sure that your rules work

International Travel Notice - Exclude travelling users and let them keep their access to work resources while on holidays or overseas

When a user goes overseas and needs access to the company resources, you should temporarily exclude them from the Block Access policy.

Traveling users should inform and request access prior to their departure. A good way to do this is via Microsoft Forms:

internationaltravel — Figure: Good example - Inform of your travel using an easy form

Otherwise they will get this message:

conditionalaccess — Figure: Bad example - You get this error message: "You cannot access this right now"

In-Flight Wi-Fi

When using in-flight Wi-Fi, even on domestic flights, you may occasionally lose access to Microsoft services. This occurs because most in-flight Wi-Fi providers rely on satellite networks that span multiple countries. As a result, your network traffic may appear to originate from a foreign location, which can trigger blocks depending on how your conditional access policies are configured.

To prevent this, we recommend connecting through your corporate VPN so that your connection is identified as coming from a trusted location.

Security