diff --git a/Config/ConditionalAccess/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA.json b/Config/2024.4.1/ConditionalAccess/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA.json similarity index 100% rename from Config/ConditionalAccess/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA.json rename to Config/2024.4.1/ConditionalAccess/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA.json diff --git a/Config/ConditionalAccess/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist.json b/Config/2024.4.1/ConditionalAccess/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist.json similarity index 100% rename from Config/ConditionalAccess/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist.json rename to Config/2024.4.1/ConditionalAccess/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist.json diff --git a/Config/ConditionalAccess/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication.json b/Config/2024.4.1/ConditionalAccess/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication.json similarity index 100% rename from Config/ConditionalAccess/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication.json rename to Config/2024.4.1/ConditionalAccess/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication.json diff --git a/Config/ConditionalAccess/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA.json b/Config/2024.4.1/ConditionalAccess/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA.json similarity index 100% rename from Config/ConditionalAccess/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA.json rename to Config/2024.4.1/ConditionalAccess/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA.json diff --git a/Config/ConditionalAccess/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows.json b/Config/2024.4.1/ConditionalAccess/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows.json similarity index 100% rename from Config/ConditionalAccess/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows.json rename to Config/2024.4.1/ConditionalAccess/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows.json diff --git a/Config/ConditionalAccess/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload.json b/Config/2024.4.1/ConditionalAccess/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload.json similarity index 100% rename from Config/ConditionalAccess/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload.json rename to Config/2024.4.1/ConditionalAccess/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload.json diff --git a/Config/ConditionalAccess/CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA.json b/Config/2024.4.1/ConditionalAccess/CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA.json similarity index 100% rename from Config/ConditionalAccess/CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA.json rename to Config/2024.4.1/ConditionalAccess/CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA.json diff --git a/Config/ConditionalAccess/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA.json b/Config/2024.4.1/ConditionalAccess/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA.json similarity index 100% rename from Config/ConditionalAccess/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA.json rename to Config/2024.4.1/ConditionalAccess/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA.json diff --git a/Config/ConditionalAccess/CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json b/Config/2024.4.1/ConditionalAccess/CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json similarity index 100% rename from Config/ConditionalAccess/CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json rename to Config/2024.4.1/ConditionalAccess/CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json diff --git a/Config/ConditionalAccess/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA.json b/Config/2024.4.1/ConditionalAccess/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA.json similarity index 100% rename from Config/ConditionalAccess/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA.json rename to Config/2024.4.1/ConditionalAccess/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA.json diff --git a/Config/ConditionalAccess/CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRisk.json b/Config/2024.4.1/ConditionalAccess/CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRisk.json similarity index 100% rename from Config/ConditionalAccess/CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRisk.json rename to Config/2024.4.1/ConditionalAccess/CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRisk.json diff --git a/Config/ConditionalAccess/CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices.json b/Config/2024.4.1/ConditionalAccess/CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices.json similarity index 100% rename from Config/ConditionalAccess/CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices.json rename to Config/2024.4.1/ConditionalAccess/CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices.json diff --git a/Config/ConditionalAccess/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA.json b/Config/2024.4.1/ConditionalAccess/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA.json similarity index 100% rename from Config/ConditionalAccess/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA.json rename to Config/2024.4.1/ConditionalAccess/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA.json diff --git a/Config/ConditionalAccess/CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms.json b/Config/2024.4.1/ConditionalAccess/CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms.json similarity index 100% rename from Config/ConditionalAccess/CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms.json rename to Config/2024.4.1/ConditionalAccess/CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms.json diff --git a/Config/ConditionalAccess/CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ.json b/Config/2024.4.1/ConditionalAccess/CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ.json similarity index 100% rename from Config/ConditionalAccess/CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ.json rename to Config/2024.4.1/ConditionalAccess/CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ.json diff --git a/Config/ConditionalAccess/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA.json b/Config/2024.4.1/ConditionalAccess/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA.json similarity index 100% rename from Config/ConditionalAccess/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA.json rename to Config/2024.4.1/ConditionalAccess/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA.json diff --git a/Config/ConditionalAccess/CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess.json b/Config/2024.4.1/ConditionalAccess/CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess.json similarity index 100% rename from Config/ConditionalAccess/CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess.json rename to Config/2024.4.1/ConditionalAccess/CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess.json diff --git a/Config/ConditionalAccess/CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json b/Config/2024.4.1/ConditionalAccess/CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json similarity index 100% rename from Config/ConditionalAccess/CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json rename to Config/2024.4.1/ConditionalAccess/CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json diff --git a/Config/Groups/APP_Microsoft365_E5_Dev.json b/Config/2024.4.1/Groups/APP_Microsoft365_E5_Dev.json similarity index 100% rename from Config/Groups/APP_Microsoft365_E5_Dev.json rename to Config/2024.4.1/Groups/APP_Microsoft365_E5_Dev.json diff --git a/Config/Groups/CA-BreakGlassAccounts - Exclude.json b/Config/2024.4.1/Groups/CA-BreakGlassAccounts - Exclude.json similarity index 100% rename from Config/Groups/CA-BreakGlassAccounts - Exclude.json rename to Config/2024.4.1/Groups/CA-BreakGlassAccounts - Exclude.json diff --git a/Config/Groups/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json b/Config/2024.4.1/Groups/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json similarity index 100% rename from Config/Groups/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json rename to Config/2024.4.1/Groups/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json diff --git a/Config/Groups/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist - Exclude.json b/Config/2024.4.1/Groups/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist - Exclude.json similarity index 100% rename from Config/Groups/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist - Exclude.json rename to Config/2024.4.1/Groups/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist - Exclude.json diff --git a/Config/Groups/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication - Exclude.json b/Config/2024.4.1/Groups/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication - Exclude.json similarity index 100% rename from Config/Groups/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication - Exclude.json rename to Config/2024.4.1/Groups/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication - Exclude.json diff --git a/Config/Groups/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA - Exclude.json b/Config/2024.4.1/Groups/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA - Exclude.json similarity index 100% rename from Config/Groups/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA - Exclude.json rename to Config/2024.4.1/Groups/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA - Exclude.json diff --git a/Config/Groups/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows - Exclude.json b/Config/2024.4.1/Groups/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows - Exclude.json similarity index 100% rename from Config/Groups/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows - Exclude.json rename to Config/2024.4.1/Groups/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows - Exclude.json diff --git a/Config/Groups/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload - Exclude.json b/Config/2024.4.1/Groups/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload - Exclude.json similarity index 100% rename from Config/Groups/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload - Exclude.json rename to Config/2024.4.1/Groups/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload - Exclude.json diff --git a/Config/Groups/CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA - Exclude.json b/Config/2024.4.1/Groups/CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA - Exclude.json similarity index 100% rename from Config/Groups/CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA - Exclude.json rename to Config/2024.4.1/Groups/CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA - Exclude.json diff --git a/Config/Groups/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json b/Config/2024.4.1/Groups/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json similarity index 100% rename from Config/Groups/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json rename to Config/2024.4.1/Groups/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json diff --git a/Config/Groups/CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency - Exclude.json b/Config/2024.4.1/Groups/CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency - Exclude.json similarity index 100% rename from Config/Groups/CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency - Exclude.json rename to Config/2024.4.1/Groups/CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency - Exclude.json diff --git a/Config/Groups/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json b/Config/2024.4.1/Groups/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json similarity index 100% rename from Config/Groups/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json rename to Config/2024.4.1/Groups/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json diff --git a/Config/Groups/CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRisk - Exclude.json b/Config/2024.4.1/Groups/CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRisk - Exclude.json similarity index 100% rename from Config/Groups/CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRisk - Exclude.json rename to Config/2024.4.1/Groups/CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRisk - Exclude.json diff --git a/Config/Groups/CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices - Exclude.json b/Config/2024.4.1/Groups/CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices - Exclude.json similarity index 100% rename from Config/Groups/CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices - Exclude.json rename to Config/2024.4.1/Groups/CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices - Exclude.json diff --git a/Config/Groups/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA - Exclude.json b/Config/2024.4.1/Groups/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA - Exclude.json similarity index 100% rename from Config/Groups/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA - Exclude.json rename to Config/2024.4.1/Groups/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA - Exclude.json diff --git a/Config/Groups/CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms - Exclude.json b/Config/2024.4.1/Groups/CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms - Exclude.json similarity index 100% rename from Config/Groups/CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms - Exclude.json rename to Config/2024.4.1/Groups/CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms - Exclude.json diff --git a/Config/Groups/CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ - Exclude.json b/Config/2024.4.1/Groups/CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ - Exclude.json similarity index 100% rename from Config/Groups/CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ - Exclude.json rename to Config/2024.4.1/Groups/CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ - Exclude.json diff --git a/Config/Groups/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json b/Config/2024.4.1/Groups/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json similarity index 100% rename from Config/Groups/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json rename to Config/2024.4.1/Groups/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json diff --git a/Config/Groups/CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess - Exclude.json b/Config/2024.4.1/Groups/CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess - Exclude.json similarity index 100% rename from Config/Groups/CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess - Exclude.json rename to Config/2024.4.1/Groups/CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess - Exclude.json diff --git a/Config/Groups/CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency - Exclude.json b/Config/2024.4.1/Groups/CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency - Exclude.json similarity index 100% rename from Config/Groups/CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency - Exclude.json rename to Config/2024.4.1/Groups/CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency - Exclude.json diff --git a/Config/MigrationTable.json b/Config/2024.4.1/MigrationTable.json similarity index 100% rename from Config/MigrationTable.json rename to Config/2024.4.1/MigrationTable.json diff --git a/Config/NamedLocations/ALLOWED COUNTRIES.json b/Config/2024.4.1/NamedLocations/ALLOWED COUNTRIES.json similarity index 100% rename from Config/NamedLocations/ALLOWED COUNTRIES.json rename to Config/2024.4.1/NamedLocations/ALLOWED COUNTRIES.json diff --git a/Config/2024.6.1/ConditionalAccess/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA.json b/Config/2024.6.1/ConditionalAccess/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA.json new file mode 100644 index 0000000..db85059 Binary files /dev/null and b/Config/2024.6.1/ConditionalAccess/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA.json differ diff --git a/Config/2024.6.1/ConditionalAccess/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist.json b/Config/2024.6.1/ConditionalAccess/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist.json new file mode 100644 index 0000000..e98731d Binary files /dev/null and b/Config/2024.6.1/ConditionalAccess/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist.json differ diff --git a/Config/2024.6.1/ConditionalAccess/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication.json b/Config/2024.6.1/ConditionalAccess/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication.json new file mode 100644 index 0000000..bf4c832 Binary files /dev/null and b/Config/2024.6.1/ConditionalAccess/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication.json differ diff --git a/Config/2024.6.1/ConditionalAccess/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA.json b/Config/2024.6.1/ConditionalAccess/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA.json new file mode 100644 index 0000000..0689557 Binary files /dev/null and b/Config/2024.6.1/ConditionalAccess/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA.json differ diff --git a/Config/2024.6.1/ConditionalAccess/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows.json b/Config/2024.6.1/ConditionalAccess/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows.json new file mode 100644 index 0000000..291d736 Binary files /dev/null and b/Config/2024.6.1/ConditionalAccess/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows.json differ diff --git a/Config/2024.6.1/ConditionalAccess/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload.json b/Config/2024.6.1/ConditionalAccess/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload.json new file mode 100644 index 0000000..7a43465 Binary files /dev/null and b/Config/2024.6.1/ConditionalAccess/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload.json differ diff --git a/Config/2024.6.1/ConditionalAccess/CA006-Global-DataProtection-Office365-iOSenAndroid-RequireAppProtection.json b/Config/2024.6.1/ConditionalAccess/CA006-Global-DataProtection-Office365-iOSenAndroid-RequireAppProtection.json new file mode 100644 index 0000000..ba66c1d Binary files /dev/null and b/Config/2024.6.1/ConditionalAccess/CA006-Global-DataProtection-Office365-iOSenAndroid-RequireAppProtection.json differ diff --git a/Config/2024.6.1/ConditionalAccess/CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA.json b/Config/2024.6.1/ConditionalAccess/CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA.json new file mode 100644 index 0000000..6f3fc59 Binary files /dev/null and b/Config/2024.6.1/ConditionalAccess/CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA.json differ diff --git a/Config/2024.6.1/ConditionalAccess/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA.json b/Config/2024.6.1/ConditionalAccess/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA.json new file mode 100644 index 0000000..28afca5 Binary files /dev/null and b/Config/2024.6.1/ConditionalAccess/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA.json differ diff --git a/Config/2024.6.1/ConditionalAccess/CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json b/Config/2024.6.1/ConditionalAccess/CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json new file mode 100644 index 0000000..063d306 Binary files /dev/null and b/Config/2024.6.1/ConditionalAccess/CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json differ diff --git a/Config/2024.6.1/ConditionalAccess/CA103-Admins-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json b/Config/2024.6.1/ConditionalAccess/CA103-Admins-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json new file mode 100644 index 0000000..308e590 Binary files /dev/null and b/Config/2024.6.1/ConditionalAccess/CA103-Admins-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json differ diff --git a/Config/2024.6.1/ConditionalAccess/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA.json b/Config/2024.6.1/ConditionalAccess/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA.json new file mode 100644 index 0000000..e9c3d1e Binary files /dev/null and b/Config/2024.6.1/ConditionalAccess/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA.json differ diff --git a/Config/2024.6.1/ConditionalAccess/CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRisk.json b/Config/2024.6.1/ConditionalAccess/CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRisk.json new file mode 100644 index 0000000..7fcc87b Binary files /dev/null and b/Config/2024.6.1/ConditionalAccess/CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRisk.json differ diff --git a/Config/2024.6.1/ConditionalAccess/CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices.json b/Config/2024.6.1/ConditionalAccess/CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices.json new file mode 100644 index 0000000..70a9d85 Binary files /dev/null and b/Config/2024.6.1/ConditionalAccess/CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices.json differ diff --git a/Config/2024.6.1/ConditionalAccess/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA.json b/Config/2024.6.1/ConditionalAccess/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA.json new file mode 100644 index 0000000..81bf207 Binary files /dev/null and b/Config/2024.6.1/ConditionalAccess/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA.json differ diff --git a/Config/2024.6.1/ConditionalAccess/CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms.json b/Config/2024.6.1/ConditionalAccess/CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms.json new file mode 100644 index 0000000..7e58c5c Binary files /dev/null and b/Config/2024.6.1/ConditionalAccess/CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms.json differ diff --git a/Config/2024.6.1/ConditionalAccess/CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ.json b/Config/2024.6.1/ConditionalAccess/CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ.json new file mode 100644 index 0000000..8f2df63 Binary files /dev/null and b/Config/2024.6.1/ConditionalAccess/CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ.json differ diff --git a/Config/2024.6.1/ConditionalAccess/CA206-Internals-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json b/Config/2024.6.1/ConditionalAccess/CA206-Internals-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json new file mode 100644 index 0000000..992b31e Binary files /dev/null and b/Config/2024.6.1/ConditionalAccess/CA206-Internals-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json differ diff --git a/Config/2024.6.1/ConditionalAccess/CA207-Internals-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK.json b/Config/2024.6.1/ConditionalAccess/CA207-Internals-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK.json new file mode 100644 index 0000000..1acc5e1 Binary files /dev/null and b/Config/2024.6.1/ConditionalAccess/CA207-Internals-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK.json differ diff --git a/Config/2024.6.1/ConditionalAccess/CA208-Internals-BaseProtection-AnyApp-MacOS-Compliant.json b/Config/2024.6.1/ConditionalAccess/CA208-Internals-BaseProtection-AnyApp-MacOS-Compliant.json new file mode 100644 index 0000000..f350a43 Binary files /dev/null and b/Config/2024.6.1/ConditionalAccess/CA208-Internals-BaseProtection-AnyApp-MacOS-Compliant.json differ diff --git a/Config/2024.6.1/ConditionalAccess/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA.json b/Config/2024.6.1/ConditionalAccess/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA.json new file mode 100644 index 0000000..32d08fa Binary files /dev/null and b/Config/2024.6.1/ConditionalAccess/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA.json differ diff --git a/Config/2024.6.1/ConditionalAccess/CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess.json b/Config/2024.6.1/ConditionalAccess/CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess.json new file mode 100644 index 0000000..ef03592 Binary files /dev/null and b/Config/2024.6.1/ConditionalAccess/CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess.json differ diff --git a/Config/2024.6.1/ConditionalAccess/CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json b/Config/2024.6.1/ConditionalAccess/CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json new file mode 100644 index 0000000..0b10619 Binary files /dev/null and b/Config/2024.6.1/ConditionalAccess/CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json differ diff --git a/Config/2024.6.1/ConditionalAccess/CA403-GuestUsers-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json b/Config/2024.6.1/ConditionalAccess/CA403-GuestUsers-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json new file mode 100644 index 0000000..a1f6b21 Binary files /dev/null and b/Config/2024.6.1/ConditionalAccess/CA403-GuestUsers-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json differ diff --git a/Config/2024.6.1/ConditionalAccess/CA404-GuestUsers-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK.json b/Config/2024.6.1/ConditionalAccess/CA404-GuestUsers-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK.json new file mode 100644 index 0000000..b0f7c66 Binary files /dev/null and b/Config/2024.6.1/ConditionalAccess/CA404-GuestUsers-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK.json differ diff --git a/Config/2024.6.1/Groups/APP_Microsoft365_E5.json b/Config/2024.6.1/Groups/APP_Microsoft365_E5.json new file mode 100644 index 0000000..8f0aad2 Binary files /dev/null and b/Config/2024.6.1/Groups/APP_Microsoft365_E5.json differ diff --git a/Config/2024.6.1/Groups/APP_Microsoft365_E5_Dev.json b/Config/2024.6.1/Groups/APP_Microsoft365_E5_Dev.json new file mode 100644 index 0000000..734d407 Binary files /dev/null and b/Config/2024.6.1/Groups/APP_Microsoft365_E5_Dev.json differ diff --git a/Config/2024.6.1/Groups/CA-BreakGlassAccounts - Exclude.json b/Config/2024.6.1/Groups/CA-BreakGlassAccounts - Exclude.json new file mode 100644 index 0000000..013e7b1 Binary files /dev/null and b/Config/2024.6.1/Groups/CA-BreakGlassAccounts - Exclude.json differ diff --git a/Config/2024.6.1/Groups/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json b/Config/2024.6.1/Groups/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json new file mode 100644 index 0000000..53b6472 Binary files /dev/null and b/Config/2024.6.1/Groups/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json differ diff --git a/Config/2024.6.1/Groups/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist - Exclude.json b/Config/2024.6.1/Groups/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist - Exclude.json new file mode 100644 index 0000000..9ae132b Binary files /dev/null and b/Config/2024.6.1/Groups/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist - Exclude.json differ diff --git a/Config/2024.6.1/Groups/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication - Exclude.json b/Config/2024.6.1/Groups/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication - Exclude.json new file mode 100644 index 0000000..8daa0a4 Binary files /dev/null and b/Config/2024.6.1/Groups/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication - Exclude.json differ diff --git a/Config/2024.6.1/Groups/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA - Exclude.json b/Config/2024.6.1/Groups/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA - Exclude.json new file mode 100644 index 0000000..a41d980 Binary files /dev/null and b/Config/2024.6.1/Groups/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA - Exclude.json differ diff --git a/Config/2024.6.1/Groups/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows - Exclude.json b/Config/2024.6.1/Groups/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows - Exclude.json new file mode 100644 index 0000000..3376792 Binary files /dev/null and b/Config/2024.6.1/Groups/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows - Exclude.json differ diff --git a/Config/2024.6.1/Groups/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload - Exclude.json b/Config/2024.6.1/Groups/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload - Exclude.json new file mode 100644 index 0000000..f949fb2 Binary files /dev/null and b/Config/2024.6.1/Groups/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload - Exclude.json differ diff --git a/Config/2024.6.1/Groups/CA006-Global-DataProtection-Office365-iOSenAndroid-RequireAppProtection - Exclude.json b/Config/2024.6.1/Groups/CA006-Global-DataProtection-Office365-iOSenAndroid-RequireAppProtection - Exclude.json new file mode 100644 index 0000000..ed0f7e3 Binary files /dev/null and b/Config/2024.6.1/Groups/CA006-Global-DataProtection-Office365-iOSenAndroid-RequireAppProtection - Exclude.json differ diff --git a/Config/2024.6.1/Groups/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json b/Config/2024.6.1/Groups/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json new file mode 100644 index 0000000..ef815df Binary files /dev/null and b/Config/2024.6.1/Groups/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json differ diff --git a/Config/2024.6.1/Groups/CA103-Admins-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser - Exclude.json b/Config/2024.6.1/Groups/CA103-Admins-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser - Exclude.json new file mode 100644 index 0000000..d15c16a Binary files /dev/null and b/Config/2024.6.1/Groups/CA103-Admins-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser - Exclude.json differ diff --git a/Config/2024.6.1/Groups/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json b/Config/2024.6.1/Groups/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json new file mode 100644 index 0000000..78afa2e Binary files /dev/null and b/Config/2024.6.1/Groups/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json differ diff --git a/Config/2024.6.1/Groups/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA - Exclude.json b/Config/2024.6.1/Groups/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA - Exclude.json new file mode 100644 index 0000000..330bf35 Binary files /dev/null and b/Config/2024.6.1/Groups/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA - Exclude.json differ diff --git a/Config/2024.6.1/Groups/CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ - Exclude.json b/Config/2024.6.1/Groups/CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ - Exclude.json new file mode 100644 index 0000000..c197da1 Binary files /dev/null and b/Config/2024.6.1/Groups/CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ - Exclude.json differ diff --git a/Config/2024.6.1/Groups/CA207-Internals-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK - Exclude.json b/Config/2024.6.1/Groups/CA207-Internals-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK - Exclude.json new file mode 100644 index 0000000..1374831 Binary files /dev/null and b/Config/2024.6.1/Groups/CA207-Internals-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK - Exclude.json differ diff --git a/Config/2024.6.1/Groups/CA208-Internals-BaseProtection-AnyApp-MacOS-Compliant - Exclude.json b/Config/2024.6.1/Groups/CA208-Internals-BaseProtection-AnyApp-MacOS-Compliant - Exclude.json new file mode 100644 index 0000000..d60849b Binary files /dev/null and b/Config/2024.6.1/Groups/CA208-Internals-BaseProtection-AnyApp-MacOS-Compliant - Exclude.json differ diff --git a/Config/2024.6.1/Groups/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json b/Config/2024.6.1/Groups/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json new file mode 100644 index 0000000..dcceab2 Binary files /dev/null and b/Config/2024.6.1/Groups/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json differ diff --git a/Config/2024.6.1/Groups/CA403-Guests-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser - Exclude.json b/Config/2024.6.1/Groups/CA403-Guests-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser - Exclude.json new file mode 100644 index 0000000..cb76cd8 Binary files /dev/null and b/Config/2024.6.1/Groups/CA403-Guests-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser - Exclude.json differ diff --git a/Config/2024.6.1/Groups/CA404-Guests-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK - Exclude.json b/Config/2024.6.1/Groups/CA404-Guests-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK - Exclude.json new file mode 100644 index 0000000..5f65285 Binary files /dev/null and b/Config/2024.6.1/Groups/CA404-Guests-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK - Exclude.json differ diff --git a/Config/2024.6.1/MigrationTable.json b/Config/2024.6.1/MigrationTable.json new file mode 100644 index 0000000..bb681f6 Binary files /dev/null and b/Config/2024.6.1/MigrationTable.json differ diff --git a/Config/2024.6.1/NamedLocations/ALLOWED COUNTRIES.json b/Config/2024.6.1/NamedLocations/ALLOWED COUNTRIES.json new file mode 100644 index 0000000..99306e7 Binary files /dev/null and b/Config/2024.6.1/NamedLocations/ALLOWED COUNTRIES.json differ diff --git a/Images/CA005.png b/Images/CA005.png index 1a82d95..9ce7ad2 100644 Binary files a/Images/CA005.png and b/Images/CA005.png differ diff --git a/Images/CA006.png b/Images/CA006.png new file mode 100644 index 0000000..b8aa25e Binary files /dev/null and b/Images/CA006.png differ diff --git a/Images/CA100.png b/Images/CA100.png index b54a63e..a205094 100644 Binary files a/Images/CA100.png and b/Images/CA100.png differ diff --git a/Images/CA101.png b/Images/CA101.png index 6ce4541..84d60d7 100644 Binary files a/Images/CA101.png and b/Images/CA101.png differ diff --git a/Images/CA103.png b/Images/CA103.png new file mode 100644 index 0000000..e85b6a6 Binary files /dev/null and b/Images/CA103.png differ diff --git a/Images/CA206.png b/Images/CA206.png new file mode 100644 index 0000000..951ad22 Binary files /dev/null and b/Images/CA206.png differ diff --git a/Images/CA207.png b/Images/CA207.png new file mode 100644 index 0000000..687fb2f Binary files /dev/null and b/Images/CA207.png differ diff --git a/Images/CA208.png b/Images/CA208.png new file mode 100644 index 0000000..bc1216e Binary files /dev/null and b/Images/CA208.png differ diff --git a/Images/CA403.png b/Images/CA403.png new file mode 100644 index 0000000..d3719d0 Binary files /dev/null and b/Images/CA403.png differ diff --git a/Images/CA404.png b/Images/CA404.png new file mode 100644 index 0000000..2eabe5c Binary files /dev/null and b/Images/CA404.png differ diff --git a/Images/image2.png b/Images/image2.png index f365f99..5fb879c 100644 Binary files a/Images/image2.png and b/Images/image2.png differ diff --git a/README.md b/README.md index c70368f..a9577f9 100644 --- a/README.md +++ b/README.md @@ -15,6 +15,7 @@ This conditional access baseline is based on the Microsoft Conditional Access Ba - [Resources](#resources) - [Version history](#version-history) - [Changelog](#changelog) + - [2024.6.1](#202461) - [Persona's](#personas) - [Global](#global) - [Admins](#admins) @@ -27,18 +28,25 @@ This conditional access baseline is based on the Microsoft Conditional Access Ba - [CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA](#ca003-global-baseprotection-registerorjoin-anyplatform-mfa) - [CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows](#ca004-global-identityprotection-anyapp-anyplatform-authenticationflows) - [CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload](#ca005-global-dataprotection-office365-anyplatform-unmanaged-appenforcedrestrictions-blockdownload) + - [CA006-Global-DataProtection-Office365-iOSenAndroid-RequireAppProtection](#ca006-global-dataprotection-office365-iosenandroid-requireappprotection) - [CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA](#ca100-admins-identityprotection-adminportals-anyplatform-mfa) - [CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA](#ca101-admins-identityprotection-anyapp-anyplatform-mfa) - [CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency](#ca102-admins-identityprotection-allapps-anyplatform-signinfrequency) + - [CA103-Admins-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser](#ca103-admins-identityprotection-allapps-anyplatform-persistentbrowser) - [CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA](#ca200-internals-identityprotection-anyapp-anyplatform-mfa) - [CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRisk](#ca201-internals-identityprotection-anyapp-anyplatform-block-highrisk) - [CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices](#ca202-internals-identityprotection-allapps-windowsmacos-signinfrequency-unmanageddevices) - [CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA](#ca203-internals-appprotection-microsoftintuneenrollment-anyplatform-mfa) - [CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms](#ca204-internals-attacksurfacereduction-allapps-anyplatform-blockunknownplatforms) - [CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ](#ca205-internals-baseprotection-anyapp-windows-compliantoraadhj) + - [CA206-Internals-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser](#ca206-internals-identityprotection-allapps-anyplatform-persistentbrowser) + - [CA207-Internals-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK](#ca207-internals-attacksurfacereduction-selectedapps-anyplatform-block) + - [CA208-Internals-BaseProtection-AnyApp-MacOS-Compliant](#ca208-internals-baseprotection-anyapp-macos-compliant) - [CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA](#ca400-guestusers-identityprotection-anyapp-anyplatform-mfa) - [CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess](#ca401-guestusers-attacksurfacereduction-allapps-anyplatform-blocknonguestappaccess) - [CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency](#ca402-guestusers-identityprotection-allapps-anyplatform-signinfrequency) + - [CA403-Guests-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser](#ca403-guests-identityprotection-allapps-anyplatform-persistentbrowser) + - [CA404-Guests-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK](#ca404-guests-attacksurfacereduction-selectedapps-anyplatform-block) - [Named locations](#named-locations) - [Considerations](#considerations) - [Importing the baseline](#importing-the-baseline) @@ -60,11 +68,20 @@ This conditional access baseline is based on the Microsoft Conditional Access Ba | Version nr | Release date | | -------- | -------- | | 2024.4.1 | Released 10-04-2024 | -| 2024.x.x | Released xx-xx-2024 | +| 2024.6.1 | Released 26-06-2024 | ## Changelog -Changes are documented here once they are made. +### 2024.6.1 +* CA208: Added this policy to require MacOS device compliance +* CA207: Added this policy to explicitly block certain apps on any platform for the internals persona. +* CA404: Added this policy to explicitly block certain apps on any platform for the guest persona. +* CA103: Added this policy to have never persistent browser sessions on any platform for admins persona +* CA206: Added this policy to have never persistent browser sessions on any platform for internals persona +* CA403: Added this policy to have never persistent browser sessions on any platform for admins persona +* CA006: Added this policy to require App Protection for iOS and Android devices when accessing Exchange Online and SharePoint Online. +* CA100: Added a few Admin roles to require MFA. +* CA101: Added a few Admin roles to require MFA. ## Persona's @@ -141,15 +158,21 @@ This policy prevents all users from downloading, printing or syncing Office 365 ![CA005](./Images/CA005.png) +### CA006-Global-DataProtection-Office365-iOSenAndroid-RequireAppProtection + +This policy requires App Protection policies for all users when accessing Office 365 data from iOS or Android devices. Admin roles are excluded to make sure the Microsoft 365 App's on the iOS and Android devices do work. This one is designed on the principle that admin roles are only assigned to admin accounts! + +![CA006](./Images/CA006.png) + ### CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA -This policy requires MFA for certain admin roles when they access the Admin Portals. +This policy requires MFA for certain admin roles when they access the access Admin Portals. This one is designed on the principle that admin roles are only assigned to admin accounts! ![CA100](./Images/CA100.png) ### CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA -This policy requires MFA for certain admin roles when they access the any cloud app. +This policy requires MFA for certain admin roles when they access the any cloud app. This one is designed on the principle that admin roles are only assigned to admin accounts! ![CA101](./Images/CA101.png) @@ -159,13 +182,19 @@ This policy sets a Sign-in frequency for certain admin roles to a maximum of 12 ![CA102](./Images/CA102.png) +### CA103-Admins-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser + +This policy prevents having persistent browser sessions for admins from every device. + +![CA103](./Images/CA103.png) + ### CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA This policy requires MFA for all internal identities, for all cloud applications, from any platform. > [!IMPORTANT] -> Verify the included group(s) and/or add your custom groups which have all internals in it. APP_Microsoft365_E5_DEV is added as an example. +> Verify the included group(s) and/or add your custom groups which have all internals in it. APP_Microsoft365_E5 is added as an example. ![CA200](./Images/CA200.png) @@ -174,7 +203,7 @@ This policy requires MFA for all internal identities, for all cloud applications This policy blocks all internal users which have a **high risk** (sign-in and user risk) status, to all cloud apps, from all platforms. > [!IMPORTANT] -> Verify the included group(s) and/or add your custom groups which have all internals in it. APP_Microsoft365_E5_DEV is added as an example. +> Verify the included group(s) and/or add your custom groups which have all internals in it. APP_Microsoft365_E5 is added as an example. ![CA201](./Images/CA201.png) @@ -183,7 +212,7 @@ This policy blocks all internal users which have a **high risk** (sign-in and us This policy sets a Sign-in frequency to a maximum of 12 hours for internals, to all cloud apps, using unmanaged Windows or MacOS devices. > [!IMPORTANT] -> Verify the included group(s) and/or add your custom groups which have all internals in it. APP_Microsoft365_E5_DEV is added as an example. +> Verify the included group(s) and/or add your custom groups which have all internals in it. APP_Microsoft365_E5 is added as an example. ![CA202](./Images/CA202.png) @@ -192,7 +221,7 @@ This policy sets a Sign-in frequency to a maximum of 12 hours for internals, to This policy requires MFA for internals when enrolling their devices in Intune. > [!IMPORTANT] -> Verify the included group(s) and/or add your custom groups which have all internals in it. APP_Microsoft365_E5_DEV is added as an example. +> Verify the included group(s) and/or add your custom groups which have all internals in it. APP_Microsoft365_E5 is added as an example. ![CA203](./Images/CA203.png) @@ -204,7 +233,7 @@ This policy blocks unknown/unsupported device platforms for internals. > Currently only Windows, MacOS, Android and iOS are supported. If (for example) Linux or Windows Phone is allowed you need to modify the policy. > [!IMPORTANT] -> Verify the included group(s) and/or add your custom groups which have all internals in it. APP_Microsoft365_E5_DEV is added as an example. +> Verify the included group(s) and/or add your custom groups which have all internals in it. APP_Microsoft365_E5 is added as an example. ![CA204](./Images/CA204.png) @@ -213,10 +242,37 @@ This policy blocks unknown/unsupported device platforms for internals. This policy requires internals to make use of a Windows device that is compliant or AADHJ (Azure AD Hybrid Joined / Entra ID Hybrid Joined) while accessing any cloud app. > [!IMPORTANT] -> Verify the included group(s) and/or add your custom groups which have all internals in it. APP_Microsoft365_E5_DEV is added as an example. +> Verify the included group(s) and/or add your custom groups which have all internals in it. APP_Microsoft365_E5 is added as an example. ![CA205](./Images/CA205.png) +### CA206-Internals-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser + +This policy prevents having persistent browser sessions for internals from unmanaged devices. Managed and compliant devices are excluded from the policy. + +> [!IMPORTANT] +> Verify the included group(s) and/or add your custom groups which have all internals in it. APP_Microsoft365_E5 is added as an example. + +![CA206](./Images/CA206.png) + +### CA207-Internals-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK + +This policy prevents internals from accessing specific apps. In this example i've blocked a random app. You should review the included and excluded apps. Excluding office 365 is not necessary if its not included. This is just an example. + +> [!IMPORTANT] +> Verify the included group(s) and/or add your custom groups which have all internals in it. APP_Microsoft365_E5 is added as an example. + +![CA207](./Images/CA207.png) + +### CA208-Internals-BaseProtection-AnyApp-MacOS-Compliant + +This policy requires MacOS devices to be compliant for internals. + +> [!IMPORTANT] +> Verify the included group(s) and/or add your custom groups which have all internals in it. APP_Microsoft365_E5 is added as an example. + +![CA208](./Images/CA208.png) + ### CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA This policy requires guest to use MFA, from any platform when accessing any cloud app. @@ -238,6 +294,18 @@ This policy sets a Sign-in frequency to a maximum of 12 hours for guests, to all ![CA402](./Images/CA402.png) +### CA403-Guests-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser + +This policy prevents guest from having persistent browser sessions. + +![CA403](./Images/CA403.png) + +### CA404-Guests-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK + +This policy prevents guests from accessing specific apps. In this example i've blocked a random app. You should review the included and excluded apps. Excluding office 365 is not necessary if its not included. This is just an example. + +![CA404](./Images/CA404.png) + ## Named locations | Name | Location type | Assigned to policy |