diff --git a/Config/ConditionalAccess/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA.json b/Config/ConditionalAccess/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA.json index 30a4763..b585912 100644 Binary files a/Config/ConditionalAccess/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA.json and b/Config/ConditionalAccess/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA.json differ diff --git a/Config/ConditionalAccess/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist.json b/Config/ConditionalAccess/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist.json index 0c534b2..a9136c3 100644 Binary files a/Config/ConditionalAccess/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist.json and b/Config/ConditionalAccess/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist.json differ diff --git a/Config/ConditionalAccess/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication.json b/Config/ConditionalAccess/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication.json index 3a9937f..de0c7f2 100644 Binary files a/Config/ConditionalAccess/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication.json and b/Config/ConditionalAccess/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication.json differ diff --git a/Config/ConditionalAccess/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA.json b/Config/ConditionalAccess/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA.json index 9692d1f..ab36052 100644 Binary files a/Config/ConditionalAccess/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA.json and b/Config/ConditionalAccess/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA.json differ diff --git a/Config/ConditionalAccess/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows.json b/Config/ConditionalAccess/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows.json index f80666c..b493c25 100644 Binary files a/Config/ConditionalAccess/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows.json and b/Config/ConditionalAccess/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows.json differ diff --git a/Config/ConditionalAccess/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload.json b/Config/ConditionalAccess/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload.json deleted file mode 100644 index 42b8c5e..0000000 --- a/Config/ConditionalAccess/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload.json +++ /dev/null @@ -1,126 +0,0 @@ -{ - "@odata.type": "#microsoft.graph.conditionalAccessPolicy", - "@odata.id": "identity/conditionalAccess/policies(\u00278cf1fcb1-c834-43c6-be35-5e11114999f8\u0027)", - "@odata.editLink": "identity/conditionalAccess/policies(\u00278cf1fcb1-c834-43c6-be35-5e11114999f8\u0027)", - "templateId": null, - "displayName": "CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload", - "createdDateTime@odata.type": "#DateTimeOffset", - "modifiedDateTime@odata.type": "#DateTimeOffset", - "state@odata.type": "#microsoft.graph.conditionalAccessPolicyState", - "state": "enabled", - "deletedDateTime": null, - "grantControls": null, - "partialEnablementStrategy": null, - "conditions": { - "@odata.type": "#microsoft.graph.conditionalAccessConditionSet", - "userRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)", - "userRiskLevels": [ - - ], - "signInRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)", - "signInRiskLevels": [ - - ], - "clientAppTypes@odata.type": "#Collection(microsoft.graph.conditionalAccessClientApp)", - "clientAppTypes": [ - "browser" - ], - "platforms": null, - "locations": null, - "times": null, - "deviceStates": null, - "clientApplications": null, - "applications": { - "@odata.type": "#microsoft.graph.conditionalAccessApplications", - "includeApplications@odata.type": "#Collection(String)", - "includeApplications": [ - "Office365" - ], - "excludeApplications@odata.type": "#Collection(String)", - "excludeApplications": [ - - ], - "includeUserActions@odata.type": "#Collection(String)", - "includeUserActions": [ - - ], - "includeAuthenticationContextClassReferences@odata.type": "#Collection(String)", - "includeAuthenticationContextClassReferences": [ - - ], - "applicationFilter": null - }, - "users": { - "@odata.type": "#microsoft.graph.conditionalAccessUsers", - "includeUsers@odata.type": "#Collection(String)", - "includeUsers": [ - "All" - ], - "excludeUsers@odata.type": "#Collection(String)", - "excludeUsers": [ - - ], - "includeGroups@odata.type": "#Collection(String)", - "includeGroups": [ - - ], - "excludeGroups@odata.type": "#Collection(String)", - "excludeGroups": [ - "2802b872-ccfb-4b29-a9a9-459808dfb11b", - "20cd89e3-25e2-4fcd-82c5-de666dfd31a4" - ], - "includeRoles@odata.type": "#Collection(String)", - "includeRoles": [ - - ], - "excludeRoles@odata.type": "#Collection(String)", - "excludeRoles": [ - - ], - "includeGuestsOrExternalUsers": null, - "excludeGuestsOrExternalUsers": null - }, - "devices": { - "@odata.type": "#microsoft.graph.conditionalAccessDevices", - "includeDeviceStates@odata.type": "#Collection(String)", - "includeDeviceStates": [ - - ], - "excludeDeviceStates@odata.type": "#Collection(String)", - "excludeDeviceStates": [ - - ], - "includeDevices@odata.type": "#Collection(String)", - "includeDevices": [ - - ], - "excludeDevices@odata.type": "#Collection(String)", - "excludeDevices": [ - - ], - "deviceFilter": { - "@odata.type": "#microsoft.graph.conditionalAccessFilter", - "mode@odata.type": "#microsoft.graph.filterMode", - "mode": "exclude", - "rule": "device.isCompliant -eq True -and device.deviceOwnership -eq \"Company\"" - } - } - }, - "sessionControls": { - "@odata.type": "#microsoft.graph.conditionalAccessSessionControls", - "disableResilienceDefaults": null, - "cloudAppSecurity": null, - "signInFrequency": null, - "persistentBrowser": null, - "continuousAccessEvaluation": null, - "secureSignInSession": null, - "applicationEnforcedRestrictions": { - "@odata.type": "#microsoft.graph.applicationEnforcedRestrictionsSessionControl", - "isEnabled": true - } - }, - "#microsoft.graph.restore": { - "title": "microsoft.graph.restore", - "target": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies(\u00278cf1fcb1-c834-43c6-be35-5e11114999f8\u0027)/microsoft.graph.restore" - } -} diff --git a/Config/ConditionalAccess/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-RequireAppProtection.json b/Config/ConditionalAccess/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-RequireAppProtection.json new file mode 100644 index 0000000..4edae91 Binary files /dev/null and b/Config/ConditionalAccess/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-RequireAppProtection.json differ diff --git a/Config/ConditionalAccess/CA006-Global-DataProtection-Office365-iOSenAndroid-RequireAppProtection.json b/Config/ConditionalAccess/CA006-Global-DataProtection-Office365-iOSenAndroid-RequireAppProtection.json index 78ae6b1..0e43e09 100644 Binary files a/Config/ConditionalAccess/CA006-Global-DataProtection-Office365-iOSenAndroid-RequireAppProtection.json and b/Config/ConditionalAccess/CA006-Global-DataProtection-Office365-iOSenAndroid-RequireAppProtection.json differ diff --git a/Config/ConditionalAccess/CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA.json b/Config/ConditionalAccess/CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA.json index 052a9c6..706baa8 100644 Binary files a/Config/ConditionalAccess/CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA.json and b/Config/ConditionalAccess/CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA.json differ diff --git a/Config/ConditionalAccess/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA.json b/Config/ConditionalAccess/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA.json index 2d422d0..8179360 100644 Binary files a/Config/ConditionalAccess/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA.json and b/Config/ConditionalAccess/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA.json differ diff --git a/Config/ConditionalAccess/CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json b/Config/ConditionalAccess/CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json index fe4c16e..c7b8351 100644 Binary files a/Config/ConditionalAccess/CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json and b/Config/ConditionalAccess/CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json differ diff --git a/Config/ConditionalAccess/CA103-Admins-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json b/Config/ConditionalAccess/CA103-Admins-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json index bfee4c2..c3a1df9 100644 Binary files a/Config/ConditionalAccess/CA103-Admins-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json and b/Config/ConditionalAccess/CA103-Admins-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json differ diff --git a/Config/ConditionalAccess/CA104-Admins-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation.json b/Config/ConditionalAccess/CA104-Admins-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation.json index d7acb21..f0d0a40 100644 Binary files a/Config/ConditionalAccess/CA104-Admins-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation.json and b/Config/ConditionalAccess/CA104-Admins-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation.json differ diff --git a/Config/ConditionalAccess/CA105-Admins-IdentityProtection-AnyApp-AnyPlatform-PhishingResistantMFA.json b/Config/ConditionalAccess/CA105-Admins-IdentityProtection-AnyApp-AnyPlatform-PhishingResistantMFA.json index 023c6d6..2a5d249 100644 Binary files a/Config/ConditionalAccess/CA105-Admins-IdentityProtection-AnyApp-AnyPlatform-PhishingResistantMFA.json and b/Config/ConditionalAccess/CA105-Admins-IdentityProtection-AnyApp-AnyPlatform-PhishingResistantMFA.json differ diff --git a/Config/ConditionalAccess/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA.json b/Config/ConditionalAccess/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA.json index 42bab59..7dbd87e 100644 Binary files a/Config/ConditionalAccess/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA.json and b/Config/ConditionalAccess/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA.json differ diff --git a/Config/ConditionalAccess/CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskUser.json b/Config/ConditionalAccess/CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskUser.json index 6665500..4c50a41 100644 Binary files a/Config/ConditionalAccess/CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskUser.json and b/Config/ConditionalAccess/CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskUser.json differ diff --git a/Config/ConditionalAccess/CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices.json b/Config/ConditionalAccess/CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices.json index b2b9e7a..567988d 100644 Binary files a/Config/ConditionalAccess/CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices.json and b/Config/ConditionalAccess/CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices.json differ diff --git a/Config/ConditionalAccess/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA.json b/Config/ConditionalAccess/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA.json index db49bba..702c8f4 100644 Binary files a/Config/ConditionalAccess/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA.json and b/Config/ConditionalAccess/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA.json differ diff --git a/Config/ConditionalAccess/CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms.json b/Config/ConditionalAccess/CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms.json index 7fb67b9..a9d81a1 100644 Binary files a/Config/ConditionalAccess/CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms.json and b/Config/ConditionalAccess/CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms.json differ diff --git a/Config/ConditionalAccess/CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ.json b/Config/ConditionalAccess/CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ.json index 5c55c08..b5ff530 100644 Binary files a/Config/ConditionalAccess/CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ.json and b/Config/ConditionalAccess/CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ.json differ diff --git a/Config/ConditionalAccess/CA206-Internals-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json b/Config/ConditionalAccess/CA206-Internals-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json index be2473b..9cacbca 100644 Binary files a/Config/ConditionalAccess/CA206-Internals-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json and b/Config/ConditionalAccess/CA206-Internals-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json differ diff --git a/Config/ConditionalAccess/CA207-Internals-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK.json b/Config/ConditionalAccess/CA207-Internals-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK.json index 7b0705a..f386bd8 100644 Binary files a/Config/ConditionalAccess/CA207-Internals-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK.json and b/Config/ConditionalAccess/CA207-Internals-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK.json differ diff --git a/Config/ConditionalAccess/CA208-Internals-BaseProtection-AnyApp-MacOS-Compliant.json b/Config/ConditionalAccess/CA208-Internals-BaseProtection-AnyApp-MacOS-Compliant.json index f968bc0..38a9231 100644 Binary files a/Config/ConditionalAccess/CA208-Internals-BaseProtection-AnyApp-MacOS-Compliant.json and b/Config/ConditionalAccess/CA208-Internals-BaseProtection-AnyApp-MacOS-Compliant.json differ diff --git a/Config/ConditionalAccess/CA209-Internals-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation.json b/Config/ConditionalAccess/CA209-Internals-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation.json index 0936c8b..7c9d95e 100644 Binary files a/Config/ConditionalAccess/CA209-Internals-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation.json and b/Config/ConditionalAccess/CA209-Internals-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation.json differ diff --git a/Config/ConditionalAccess/CA210-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskSignIn.json b/Config/ConditionalAccess/CA210-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskSignIn.json deleted file mode 100644 index b1850f9..0000000 --- a/Config/ConditionalAccess/CA210-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskSignIn.json +++ /dev/null @@ -1,108 +0,0 @@ -{ - "@odata.type": "#microsoft.graph.conditionalAccessPolicy", - "@odata.id": "identity/conditionalAccess/policies(\u0027a56ceb4f-0c7b-4379-a057-d5c6fabc4d94\u0027)", - "@odata.editLink": "identity/conditionalAccess/policies(\u0027a56ceb4f-0c7b-4379-a057-d5c6fabc4d94\u0027)", - "templateId": null, - "displayName": "CA210-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskSignIn", - "createdDateTime@odata.type": "#DateTimeOffset", - "state@odata.type": "#microsoft.graph.conditionalAccessPolicyState", - "state": "enabled", - "deletedDateTime": null, - "partialEnablementStrategy": null, - "sessionControls": null, - "conditions": { - "@odata.type": "#microsoft.graph.conditionalAccessConditionSet", - "userRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)", - "userRiskLevels": [ - - ], - "signInRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)", - "signInRiskLevels": [ - "high" - ], - "clientAppTypes@odata.type": "#Collection(microsoft.graph.conditionalAccessClientApp)", - "clientAppTypes": [ - "all" - ], - "platforms": null, - "locations": null, - "times": null, - "deviceStates": null, - "devices": null, - "clientApplications": null, - "applications": { - "@odata.type": "#microsoft.graph.conditionalAccessApplications", - "includeApplications@odata.type": "#Collection(String)", - "includeApplications": [ - "All" - ], - "excludeApplications@odata.type": "#Collection(String)", - "excludeApplications": [ - - ], - "includeUserActions@odata.type": "#Collection(String)", - "includeUserActions": [ - - ], - "includeAuthenticationContextClassReferences@odata.type": "#Collection(String)", - "includeAuthenticationContextClassReferences": [ - - ], - "applicationFilter": null - }, - "users": { - "@odata.type": "#microsoft.graph.conditionalAccessUsers", - "includeUsers@odata.type": "#Collection(String)", - "includeUsers": [ - - ], - "excludeUsers@odata.type": "#Collection(String)", - "excludeUsers": [ - - ], - "includeGroups@odata.type": "#Collection(String)", - "includeGroups": [ - "ceeac9b8-ddf5-48cb-afcb-e2ab8bfd1a57" - ], - "excludeGroups@odata.type": "#Collection(String)", - "excludeGroups": [ - "2802b872-ccfb-4b29-a9a9-459808dfb11b", - "669c1f87-63ac-40c3-8fc2-fcc72e690e68" - ], - "includeRoles@odata.type": "#Collection(String)", - "includeRoles": [ - - ], - "excludeRoles@odata.type": "#Collection(String)", - "excludeRoles": [ - - ], - "includeGuestsOrExternalUsers": null, - "excludeGuestsOrExternalUsers": null - } - }, - "grantControls": { - "@odata.type": "#microsoft.graph.conditionalAccessGrantControls", - "operator": "OR", - "builtInControls@odata.type": "#Collection(microsoft.graph.conditionalAccessGrantControl)", - "builtInControls": [ - "block" - ], - "customAuthenticationFactors@odata.type": "#Collection(String)", - "customAuthenticationFactors": [ - - ], - "termsOfUse@odata.type": "#Collection(String)", - "termsOfUse": [ - - ], - "authenticationStrength@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies(\u0027a56ceb4f-0c7b-4379-a057-d5c6fabc4d94\u0027)/grantControls/authenticationStrength/$entity", - "authenticationStrength@odata.associationLink": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies(\u0027a56ceb4f-0c7b-4379-a057-d5c6fabc4d94\u0027)/grantControls/authenticationStrength/$ref", - "authenticationStrength@odata.navigationLink": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies(\u0027a56ceb4f-0c7b-4379-a057-d5c6fabc4d94\u0027)/grantControls/authenticationStrength", - "authenticationStrength": null - }, - "#microsoft.graph.restore": { - "title": "microsoft.graph.restore", - "target": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies(\u0027a56ceb4f-0c7b-4379-a057-d5c6fabc4d94\u0027)/microsoft.graph.restore" - } -} diff --git a/Config/ConditionalAccess/CA300-ServiceAccounts-IdentityProtection-AnyApp-AnyPlatform-MFA.json b/Config/ConditionalAccess/CA300-ServiceAccounts-IdentityProtection-AnyApp-AnyPlatform-MFA.json index 1904036..fe3cd43 100644 Binary files a/Config/ConditionalAccess/CA300-ServiceAccounts-IdentityProtection-AnyApp-AnyPlatform-MFA.json and b/Config/ConditionalAccess/CA300-ServiceAccounts-IdentityProtection-AnyApp-AnyPlatform-MFA.json differ diff --git a/Config/ConditionalAccess/CA301-ServiceAccounts-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUntrustedLocations.json b/Config/ConditionalAccess/CA301-ServiceAccounts-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUntrustedLocations.json index 888f03d..133f076 100644 Binary files a/Config/ConditionalAccess/CA301-ServiceAccounts-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUntrustedLocations.json and b/Config/ConditionalAccess/CA301-ServiceAccounts-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUntrustedLocations.json differ diff --git a/Config/ConditionalAccess/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA.json b/Config/ConditionalAccess/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA.json index 93c98eb..31ae253 100644 Binary files a/Config/ConditionalAccess/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA.json and b/Config/ConditionalAccess/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA.json differ diff --git a/Config/ConditionalAccess/CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess.json b/Config/ConditionalAccess/CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess.json index 55076ce..928f283 100644 Binary files a/Config/ConditionalAccess/CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess.json and b/Config/ConditionalAccess/CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess.json differ diff --git a/Config/ConditionalAccess/CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json b/Config/ConditionalAccess/CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json index 0f779e6..0afe2d0 100644 Binary files a/Config/ConditionalAccess/CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json and b/Config/ConditionalAccess/CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json differ diff --git a/Config/ConditionalAccess/CA403-GuestUsers-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json b/Config/ConditionalAccess/CA403-GuestUsers-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json index ab9e488..adf9f5a 100644 Binary files a/Config/ConditionalAccess/CA403-GuestUsers-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json and b/Config/ConditionalAccess/CA403-GuestUsers-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json differ diff --git a/Config/ConditionalAccess/CA404-GuestUsers-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK.json b/Config/ConditionalAccess/CA404-GuestUsers-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK.json index 9dcc256..b38fdc5 100644 Binary files a/Config/ConditionalAccess/CA404-GuestUsers-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK.json and b/Config/ConditionalAccess/CA404-GuestUsers-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK.json differ diff --git a/Config/ConditionalAccess/CA501-Agents-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskAgent.json b/Config/ConditionalAccess/CA501-Agents-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskAgent.json new file mode 100644 index 0000000..377b213 Binary files /dev/null and b/Config/ConditionalAccess/CA501-Agents-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskAgent.json differ diff --git a/Config/Groups/APP_Microsoft365_E5_Dev.json b/Config/Groups/APP_Microsoft365_E5_Dev.json deleted file mode 100644 index 734d407..0000000 Binary files a/Config/Groups/APP_Microsoft365_E5_Dev.json and /dev/null differ diff --git a/Config/Groups/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload - Exclude.json b/Config/Groups/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-RequireAppProtection - Exclude.json similarity index 96% rename from Config/Groups/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload - Exclude.json rename to Config/Groups/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-RequireAppProtection - Exclude.json index f949fb2..acef1e9 100644 Binary files a/Config/Groups/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload - Exclude.json and b/Config/Groups/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-RequireAppProtection - Exclude.json differ diff --git a/Config/Groups/CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency - Exclude.json b/Config/Groups/CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency - Exclude.json index 35e5687..aabd070 100644 Binary files a/Config/Groups/CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency - Exclude.json and b/Config/Groups/CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency - Exclude.json differ diff --git a/Config/Groups/CA210-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskSignIn - Exclude.json b/Config/Groups/CA210-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskSignIn - Exclude.json deleted file mode 100644 index 7b66938..0000000 Binary files a/Config/Groups/CA210-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskSignIn - Exclude.json and /dev/null differ diff --git a/Config/Groups/CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess - Exclude.json b/Config/Groups/CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess - Exclude.json index 390a29c..bb26ec6 100644 Binary files a/Config/Groups/CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess - Exclude.json and b/Config/Groups/CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess - Exclude.json differ diff --git a/Config/Groups/CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency - Exclude.json b/Config/Groups/CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency - Exclude.json index 7fd659c..eb516b1 100644 Binary files a/Config/Groups/CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency - Exclude.json and b/Config/Groups/CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency - Exclude.json differ diff --git a/Config/MigrationTable.json b/Config/MigrationTable.json index c3507ba..1919792 100644 Binary files a/Config/MigrationTable.json and b/Config/MigrationTable.json differ diff --git a/Images/CA000.png b/Images/CA000.png index 5901037..32c4a7e 100644 Binary files a/Images/CA000.png and b/Images/CA000.png differ diff --git a/Images/CA001.png b/Images/CA001.png index 1a21675..90a42ec 100644 Binary files a/Images/CA001.png and b/Images/CA001.png differ diff --git a/Images/CA002.png b/Images/CA002.png index 2a44d21..201ddc9 100644 Binary files a/Images/CA002.png and b/Images/CA002.png differ diff --git a/Images/CA003.png b/Images/CA003.png index 9a9b3e2..bcc3e5a 100644 Binary files a/Images/CA003.png and b/Images/CA003.png differ diff --git a/Images/CA004.png b/Images/CA004.png index 7d0fe94..ed92f90 100644 Binary files a/Images/CA004.png and b/Images/CA004.png differ diff --git a/Images/CA005.png b/Images/CA005.png index 9ce7ad2..d46be31 100644 Binary files a/Images/CA005.png and b/Images/CA005.png differ diff --git a/Images/CA006.png b/Images/CA006.png index b8aa25e..1300020 100644 Binary files a/Images/CA006.png and b/Images/CA006.png differ diff --git a/Images/CA100.png b/Images/CA100.png index a205094..d67b771 100644 Binary files a/Images/CA100.png and b/Images/CA100.png differ diff --git a/Images/CA101.png b/Images/CA101.png index 84d60d7..8718cc1 100644 Binary files a/Images/CA101.png and b/Images/CA101.png differ diff --git a/Images/CA102.png b/Images/CA102.png index 316485a..ad457ef 100644 Binary files a/Images/CA102.png and b/Images/CA102.png differ diff --git a/Images/CA103.png b/Images/CA103.png index af2a46b..9968511 100644 Binary files a/Images/CA103.png and b/Images/CA103.png differ diff --git a/Images/CA104.png b/Images/CA104.png index f19414b..23f7de6 100644 Binary files a/Images/CA104.png and b/Images/CA104.png differ diff --git a/Images/CA105.png b/Images/CA105.png index ce6448f..ed53e94 100644 Binary files a/Images/CA105.png and b/Images/CA105.png differ diff --git a/Images/CA200.png b/Images/CA200.png index 6c3c54a..879e5af 100644 Binary files a/Images/CA200.png and b/Images/CA200.png differ diff --git a/Images/CA201.1.png b/Images/CA201.1.png deleted file mode 100644 index 89ecea3..0000000 Binary files a/Images/CA201.1.png and /dev/null differ diff --git a/Images/CA201.png b/Images/CA201.png index 686c40d..d26004e 100644 Binary files a/Images/CA201.png and b/Images/CA201.png differ diff --git a/Images/CA202.png b/Images/CA202.png index b72b0a9..ded3232 100644 Binary files a/Images/CA202.png and b/Images/CA202.png differ diff --git a/Images/CA203.png b/Images/CA203.png index 650f070..855cad8 100644 Binary files a/Images/CA203.png and b/Images/CA203.png differ diff --git a/Images/CA204.png b/Images/CA204.png index 5316626..0897832 100644 Binary files a/Images/CA204.png and b/Images/CA204.png differ diff --git a/Images/CA205.png b/Images/CA205.png index 7d5a73c..6d44d28 100644 Binary files a/Images/CA205.png and b/Images/CA205.png differ diff --git a/Images/CA206-new.png b/Images/CA206-new.png deleted file mode 100644 index f0bc79e..0000000 Binary files a/Images/CA206-new.png and /dev/null differ diff --git a/Images/CA206.png b/Images/CA206.png new file mode 100644 index 0000000..ce93528 Binary files /dev/null and b/Images/CA206.png differ diff --git a/Images/CA207.png b/Images/CA207.png index 687fb2f..ec2b5e6 100644 Binary files a/Images/CA207.png and b/Images/CA207.png differ diff --git a/Images/CA208.png b/Images/CA208.png index bc1216e..c12d17c 100644 Binary files a/Images/CA208.png and b/Images/CA208.png differ diff --git a/Images/CA209.png b/Images/CA209.png index ccf9df9..d0686bc 100644 Binary files a/Images/CA209.png and b/Images/CA209.png differ diff --git a/Images/CA210.png b/Images/CA210.png deleted file mode 100644 index 257e1fb..0000000 Binary files a/Images/CA210.png and /dev/null differ diff --git a/Images/CA300.png b/Images/CA300.png new file mode 100644 index 0000000..262f700 Binary files /dev/null and b/Images/CA300.png differ diff --git a/Images/CA301.png b/Images/CA301.png new file mode 100644 index 0000000..7850331 Binary files /dev/null and b/Images/CA301.png differ diff --git a/Images/CA400.png b/Images/CA400.png index 13b034f..b4b9faa 100644 Binary files a/Images/CA400.png and b/Images/CA400.png differ diff --git a/Images/CA401.png b/Images/CA401.png index 0a406b0..1f8c9d8 100644 Binary files a/Images/CA401.png and b/Images/CA401.png differ diff --git a/Images/CA402.png b/Images/CA402.png index 828298b..c5734fa 100644 Binary files a/Images/CA402.png and b/Images/CA402.png differ diff --git a/Images/CA403.png b/Images/CA403.png index d3719d0..299b78f 100644 Binary files a/Images/CA403.png and b/Images/CA403.png differ diff --git a/Images/CA404.png b/Images/CA404.png index 2eabe5c..a2770cc 100644 Binary files a/Images/CA404.png and b/Images/CA404.png differ diff --git a/Images/CA501.png b/Images/CA501.png new file mode 100644 index 0000000..20174e5 Binary files /dev/null and b/Images/CA501.png differ diff --git a/README.md b/README.md index 71b4d54..81cfffa 100644 --- a/README.md +++ b/README.md @@ -21,18 +21,20 @@ This conditional access baseline is based on the Microsoft Conditional Access Ba - [2025.2.1](#202521) - [2025.2.2](#202522) - [2025.2.3](#202523) + - [2026.2.1](#202621) - [Persona's](#personas) - [Global](#global) - [Admins](#admins) - [Internals](#internals) - [Guests](#guests) + - [Agents](#agents) - [Conditional access policies](#conditional-access-policies) - [CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA](#ca000-global-identityprotection-anyapp-anyplatform-mfa) - [CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist](#ca001-global-attacksurfacereduction-anyapp-anyplatform-block-countrywhitelist) - [CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication](#ca002-global-identityprotection-anyapp-anyplatform-block-legacyauthentication) - [CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA](#ca003-global-baseprotection-registerorjoin-anyplatform-mfa) - [CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows](#ca004-global-identityprotection-anyapp-anyplatform-authenticationflows) - - [CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload](#ca005-global-dataprotection-office365-anyplatform-unmanaged-appenforcedrestrictions-blockdownload) + - [CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-RequireAppProtection](#ca005-global-dataprotection-office365-anyplatform-unmanaged-requireappprotection) - [CA006-Global-DataProtection-Office365-iOSenAndroid-RequireAppProtection](#ca006-global-dataprotection-office365-iosenandroid-requireappprotection) - [CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA](#ca100-admins-identityprotection-adminportals-anyplatform-mfa) - [CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA](#ca101-admins-identityprotection-anyapp-anyplatform-mfa) @@ -50,12 +52,14 @@ This conditional access baseline is based on the Microsoft Conditional Access Ba - [CA207-Internals-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK](#ca207-internals-attacksurfacereduction-selectedapps-anyplatform-block) - [CA208-Internals-BaseProtection-AnyApp-MacOS-Compliant](#ca208-internals-baseprotection-anyapp-macos-compliant) - [CA209-Internals-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation](#ca209-internals-identityprotection-allapps-anyplatform-continuousaccessevaluation) - - [CA210-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskSignIn](#ca210-internals-identityprotection-anyapp-anyplatform-block-highrisksignin) + - [CA300-ServiceAccounts-IdentityProtection-AnyApp-AnyPlatform-MFA](#ca300-serviceaccounts-identityprotection-anyapp-anyplatform-mfa) + - [CA301-ServiceAccounts-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUntrustedLocations](#ca301-serviceaccounts-attacksurfacereduction-allapps-anyplatform-blockuntrustedlocations) - [CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA](#ca400-guestusers-identityprotection-anyapp-anyplatform-mfa) - [CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess](#ca401-guestusers-attacksurfacereduction-allapps-anyplatform-blocknonguestappaccess) - [CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency](#ca402-guestusers-identityprotection-allapps-anyplatform-signinfrequency) - [CA403-Guests-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser](#ca403-guests-identityprotection-allapps-anyplatform-persistentbrowser) - [CA404-Guests-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK](#ca404-guests-attacksurfacereduction-selectedapps-anyplatform-block) + - [CA501-Agents-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskAgent](#ca501-agents-identityprotection-anyapp-anyplatform-block-highriskagent) - [Named locations](#named-locations) - [Considerations](#considerations) - [Troubleshooting](#troubleshooting) @@ -90,6 +94,7 @@ This conditional access baseline is based on the Microsoft Conditional Access Ba | 2025.2.1 | Released 01-02-2025 | | 2025.2.2 | Released 06-02-2025 | | 2025.2.3 | Released 13-02-2025 | +| 2026.2.1 | Released 13-02-2025 | ## Changelog @@ -116,6 +121,11 @@ This conditional access baseline is based on the Microsoft Conditional Access Ba * CA201: Policy contained Signin Risk and User Risk in a single policy. Now separated into CA201 and CA210 * CA210: Separated (new) policy for Signin Risk +### 2026.2.1 +* CA501: Template policy for High Risk Agents adopted into the framework. +* CA005: Modified policy from **Require approved client app** to **RequireAppProtection** as this is being retired per March 2026. + + ## Persona's #### Global @@ -145,6 +155,9 @@ standard end-user role. Guests holds all users who have an Azure AD guest account that has been invited into the customer tenant +#### Agents +Agents covers all agent related resources which can be managed through Conditional Access + ## Conditional access policies @@ -184,9 +197,9 @@ This policy prevents all users from transfering authentication flows from PC to ![CA004](./Images/CA004.png) -### CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload +### CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-RequireAppProtection -This policy prevents all users from downloading, printing or syncing Office 365 data from an unmanaged device. It requires App Enforce Restrictions. +This policyrequires App Protection Policies on unmanaged devices. ![CA005](./Images/CA005.png) @@ -338,14 +351,23 @@ This policy allows Microsoft Entra ID to re-evaluate a user's access to resource ![CA209](./Images/CA209.png) -### CA210-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskSignIn +### CA300-ServiceAccounts-IdentityProtection-AnyApp-AnyPlatform-MFA -This policy blocks all internal users which have a **high risk** (Sign-in risk) status, to all cloud apps, from all platforms. +This policy requires ServiceAccounts to use MFA, from any platform when accessing any cloud app. > [!IMPORTANT] > Verify the included group(s) and/or add your custom groups which have all internals in it. APP_Microsoft365_E5 is added as an example. -![CA210](./Images/CA210.png) +![CA300](./Images/CA300.png) + +### CA301-ServiceAccounts-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUntrustedLocations + +This policy prevents service accounts from logging in from untrusted countries. + +> [!IMPORTANT] +> Verify the Named Location which is part of this policy. Add or Remove countries from the imported Named Location. + +![CA301](./Images/CA301.png) ### CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA @@ -383,11 +405,18 @@ This policy prevents guests from accessing specific apps. In this example i've b ![CA404](./Images/CA404.png) +### CA501-Agents-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskAgent + +This policy blocks agent identities with a high risk level from accessing resources in your tenant. + +![CA501](./Images/CA501.png) + ## Named locations | Name | Location type | Assigned to policy | | -------- | -------- | -------- | | ALLOWED COUNTRIES | Countries (IP) | CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist | +| ALLOWED COUNTRIES - SERVICE ACCOUNTS | Countries (IP) | CA301-ServiceAccounts-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUntr| ## Considerations 1. You might want to remove the "CA - BreakGlassAccounts - Exclude" group from Admin MFA policies (CA101, CA102) if they use MFA and/or only exclude 1 single BreakGlass account.