CIS.M365.5.2.2.15 - (L2) Ensure exclusionary geographic access controls are utilized
Overview
An enabled Conditional Access policy blocks access from selected untrusted locations and excludes at least one trusted location.
Most organisations know where their staff sign in from. A policy that blocks all locations except the trusted ones, or the countries you operate in, stops a large share of credential attacks that come from elsewhere without any extra step for users.
The policy must apply to all users and all cloud apps, block access and be enabled. It must include all locations or only untrusted locations (countries, or IP ranges not marked as trusted), and exclude All trusted networks and locations or at least one trusted IP location. Without a trusted-location exclusion, a block policy could block every sign-in. Plan for travelling users, for example with a temporary exclusion group, and remember that attackers can use VPNs in allowed countries, so this does not replace MFA.
User and group exclusions are not evaluated by this test. Application exclusions are also not evaluated when the policy targets all apps; verify exclusions are documented and reviewed annually. A condition that narrows the policy is reported unless the check is about that condition.
Remediation action
- Sign in to the Microsoft Entra admin center.
- Make sure your trusted locations exist in Named locations and are marked as trusted.
- Go to Entra ID > Conditional Access > Policies and select New policy.
- Under Users, include All users. Exclude your emergency access accounts.
- Under Target resources, select All resources (formerly All cloud apps).
- Under Conditions > Locations, set Configure to Yes, include Any network or location and exclude your trusted locations (or All trusted networks and locations). To block only the countries you list, select those countries under include instead.
- Under Grant, select Block access.
- Set Enable policy to On (use Report-only first to measure the impact) and select Create.
Related links
- Microsoft Entra admin center - Conditional Access policies
- Block access by location with Conditional Access
- Conditional Access: network assignments
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.2.15
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.2.2.15 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Access control |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.2.15 |
| Benchmark level | L2 |
| Benchmark profiles | E3 Level 2 |
| Supports controls | cis-m365:5.2.2.15, nist-800-53-r5:AC-3 |
| PowerShell test | Test-MtCisGeographicAccessControl |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
- Test:
tests/cis/Test.CIS.M365.5.2.2.15.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.2.2.15.md