# (L2) Ensure exclusionary geographic access controls are utilized

An enabled Conditional Access policy blocks access from selected untrusted locations and excludes at least one trusted location.

Source: https://maester.dev/docs/tests/CIS.M365.5.2.2.15

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Entra ID · Conditional Access · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.5.2.2.15
```

## Overview

An enabled Conditional Access policy blocks access from selected untrusted locations and excludes at least one trusted location.

Most organisations know where their staff sign in from. A policy that blocks all locations except the trusted ones, or the countries you operate in, stops a large share of credential attacks that come from elsewhere without any extra step for users.

The policy must apply to all users and all cloud apps, block access and be enabled. It must include all locations or only untrusted locations (countries, or IP ranges not marked as trusted), and exclude **All trusted networks and locations** or at least one trusted IP location. Without a trusted-location exclusion, a block policy could block every sign-in. Plan for travelling users, for example with a temporary exclusion group, and remember that attackers can use VPNs in allowed countries, so this does not replace MFA.

User and group exclusions are not evaluated by this test. Application exclusions are also not evaluated when the policy targets all apps; verify exclusions are documented and reviewed annually. A condition that narrows the policy is reported unless the check is about that condition.

#### Remediation action

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
2. Make sure your trusted locations exist in [Named locations](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/NamedLocations) and are marked as trusted.
3. Go to **Entra ID** > **Conditional Access** > [**Policies**](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) and select **New policy**.
4. Under **Users**, include **All users**. Exclude your emergency access accounts.
5. Under **Target resources**, select **All resources (formerly All cloud apps)**.
6. Under **Conditions** > **Locations**, set **Configure** to **Yes**, include **Any network or location** and exclude your trusted locations (or **All trusted networks and locations**). To block only the countries you list, select those countries under include instead.
7. Under **Grant**, select **Block access**.
8. Set **Enable policy** to **On** (use **Report-only** first to measure the impact) and select **Create**.

#### Related links

* [Microsoft Entra admin center - Conditional Access policies](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies)
* [Block access by location with Conditional Access](https://learn.microsoft.com/entra/identity/conditional-access/policy-block-by-location)
* [Conditional Access: network assignments](https://learn.microsoft.com/entra/identity/conditional-access/concept-assignment-network)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.2.15](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.5.2.2.15 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Access control |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.2.15 |
| Benchmark level | L2 |
| Benchmark profiles | E3 Level 2 |
| Supports controls | cis-m365:5.2.2.15, nist-800-53-r5:AC-3 |
| PowerShell test | [Test-MtCisGeographicAccessControl](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.15.ps1) |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.5.2.2.15.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.15.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.5.2.2.15.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.15.md)