Detections
Analytics

5.2.2.15 Ensure exclusionary geographic access controls are utilized

Information

Conditional Access Policies can be used to block access from geographic locations that are deemed out-of-scope for your organization or application. The scope and variables for this policy should be carefully examined and defined.

The recommended state is to configure at least one policy to block access from untrusted locations.

Using Conditional Access as a deny list at the tenant or subscription level enables an organization to block inbound and outbound traffic from geographic locations that fall outside its operational scope (e.g., customers, suppliers) or legal jurisdiction. Restricting access to only required regions significantly reduces unnecessary exposure to international threat actors, including advanced persistent threats (APTs), and helps maintain a more controlled and defensible security posture.

Note: Because the selection of allowed or blocked locations is unique to each organization, this control does not prescribe specific countries or regions. Each organization should determine its geographic access requirements based on operational needs, regulatory obligations, and risk tolerance.

Solution

To remediate using the UI:

 - Navigate to the Microsoft Entra admin center https://entra.microsoft.com.
 - Expand Entra ID > Conditional Access and select Policies.
 - Create a new policy by selecting New policy.

 - Under Users or agents (Preview) include All users

 - Under Exclude exclude any break-glass accounts.

 - Under Target resources include All resources (formerly 'All cloud apps').
 - Under Network set Configure to Yes :

 - Select Include, then add entries for untrusted locations that should be blocked
 - Select Exclude, then add entries for trusted locations that should be allowed

 - Under Access Controls, select Grant select Block Access.
 - Under Enable policy set it to Report-only.
 - Click Create.
 - After allowing the policy to run in Report-only mode for at least one week, review the Sign-in logs for any unexpected impact, then return to the policy and set Enable policy to On.

Impact:

Limiting access geographically will deny access to users that are traveling or working remotely in a different part of the world. A point-to-site or site to site tunnel such as a VPN is recommended to address exceptions to geographic access policies.

CAUTION : If these policies are created without first auditing and testing the result, misconfiguration can potentially lock out administrators or create undesired access issues.

See Also

https://workbench.cisecurity.org/benchmarks/24620

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2(1), 800-53|AC-3, CSCv7|12.1

Plugin: microsoft_azure

Control ID: d5f8a0d723655c5d87fef0ba735f5ce5e32dffb728a9c636e1d4ba3c83adf0b0