diff --git a/Config/2025.2.3/ConditionalAccess/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA.json b/Config/2025.2.3/ConditionalAccess/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA.json new file mode 100644 index 0000000..867658f Binary files /dev/null and b/Config/2025.2.3/ConditionalAccess/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA.json differ diff --git a/Config/2025.2.3/ConditionalAccess/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist.json b/Config/2025.2.3/ConditionalAccess/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist.json new file mode 100644 index 0000000..e98731d Binary files /dev/null and b/Config/2025.2.3/ConditionalAccess/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist.json differ diff --git a/Config/2025.2.3/ConditionalAccess/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication.json b/Config/2025.2.3/ConditionalAccess/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication.json new file mode 100644 index 0000000..bf4c832 Binary files /dev/null and b/Config/2025.2.3/ConditionalAccess/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication.json differ diff --git a/Config/2025.2.3/ConditionalAccess/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA.json b/Config/2025.2.3/ConditionalAccess/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA.json new file mode 100644 index 0000000..0689557 Binary files /dev/null and b/Config/2025.2.3/ConditionalAccess/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA.json differ diff --git a/Config/2025.2.3/ConditionalAccess/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows.json b/Config/2025.2.3/ConditionalAccess/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows.json new file mode 100644 index 0000000..291d736 Binary files /dev/null and b/Config/2025.2.3/ConditionalAccess/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows.json differ diff --git a/Config/2025.2.3/ConditionalAccess/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload.json b/Config/2025.2.3/ConditionalAccess/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload.json new file mode 100644 index 0000000..7a43465 Binary files /dev/null and b/Config/2025.2.3/ConditionalAccess/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload.json differ diff --git a/Config/2025.2.3/ConditionalAccess/CA006-Global-DataProtection-Office365-iOSenAndroid-RequireAppProtection.json b/Config/2025.2.3/ConditionalAccess/CA006-Global-DataProtection-Office365-iOSenAndroid-RequireAppProtection.json new file mode 100644 index 0000000..ba66c1d Binary files /dev/null and b/Config/2025.2.3/ConditionalAccess/CA006-Global-DataProtection-Office365-iOSenAndroid-RequireAppProtection.json differ diff --git a/Config/2025.2.3/ConditionalAccess/CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA.json b/Config/2025.2.3/ConditionalAccess/CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA.json new file mode 100644 index 0000000..6f3fc59 Binary files /dev/null and b/Config/2025.2.3/ConditionalAccess/CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA.json differ diff --git a/Config/2025.2.3/ConditionalAccess/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA.json b/Config/2025.2.3/ConditionalAccess/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA.json new file mode 100644 index 0000000..28afca5 Binary files /dev/null and b/Config/2025.2.3/ConditionalAccess/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA.json differ diff --git a/Config/2025.2.3/ConditionalAccess/CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json b/Config/2025.2.3/ConditionalAccess/CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json new file mode 100644 index 0000000..063d306 Binary files /dev/null and b/Config/2025.2.3/ConditionalAccess/CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json differ diff --git a/Config/2025.2.3/ConditionalAccess/CA103-Admins-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json b/Config/2025.2.3/ConditionalAccess/CA103-Admins-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json new file mode 100644 index 0000000..283d474 Binary files /dev/null and b/Config/2025.2.3/ConditionalAccess/CA103-Admins-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json differ diff --git a/Config/2025.2.3/ConditionalAccess/CA104-Admins-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation.json b/Config/2025.2.3/ConditionalAccess/CA104-Admins-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation.json new file mode 100644 index 0000000..972802a Binary files /dev/null and b/Config/2025.2.3/ConditionalAccess/CA104-Admins-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation.json differ diff --git a/Config/2025.2.3/ConditionalAccess/CA105-Admins-IdentityProtection-AnyApp-AnyPlatform-PhishingResistantMFA.json b/Config/2025.2.3/ConditionalAccess/CA105-Admins-IdentityProtection-AnyApp-AnyPlatform-PhishingResistantMFA.json new file mode 100644 index 0000000..16670a6 Binary files /dev/null and b/Config/2025.2.3/ConditionalAccess/CA105-Admins-IdentityProtection-AnyApp-AnyPlatform-PhishingResistantMFA.json differ diff --git a/Config/2025.2.3/ConditionalAccess/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA.json b/Config/2025.2.3/ConditionalAccess/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA.json new file mode 100644 index 0000000..2f7d17f Binary files /dev/null and b/Config/2025.2.3/ConditionalAccess/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA.json differ diff --git a/Config/2025.2.3/ConditionalAccess/CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskUser.json b/Config/2025.2.3/ConditionalAccess/CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskUser.json new file mode 100644 index 0000000..f344e8c Binary files /dev/null and b/Config/2025.2.3/ConditionalAccess/CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskUser.json differ diff --git a/Config/2025.2.3/ConditionalAccess/CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices.json b/Config/2025.2.3/ConditionalAccess/CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices.json new file mode 100644 index 0000000..70a9d85 Binary files /dev/null and b/Config/2025.2.3/ConditionalAccess/CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices.json differ diff --git a/Config/2025.2.3/ConditionalAccess/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA.json b/Config/2025.2.3/ConditionalAccess/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA.json new file mode 100644 index 0000000..81bf207 Binary files /dev/null and b/Config/2025.2.3/ConditionalAccess/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA.json differ diff --git a/Config/2025.2.3/ConditionalAccess/CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms.json b/Config/2025.2.3/ConditionalAccess/CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms.json new file mode 100644 index 0000000..7e58c5c Binary files /dev/null and b/Config/2025.2.3/ConditionalAccess/CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms.json differ diff --git a/Config/2025.2.3/ConditionalAccess/CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ.json b/Config/2025.2.3/ConditionalAccess/CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ.json new file mode 100644 index 0000000..8f2df63 Binary files /dev/null and b/Config/2025.2.3/ConditionalAccess/CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ.json differ diff --git a/Config/2025.2.3/ConditionalAccess/CA206-Internals-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json b/Config/2025.2.3/ConditionalAccess/CA206-Internals-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json new file mode 100644 index 0000000..5962e0f Binary files /dev/null and b/Config/2025.2.3/ConditionalAccess/CA206-Internals-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json differ diff --git a/Config/2025.2.3/ConditionalAccess/CA207-Internals-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK.json b/Config/2025.2.3/ConditionalAccess/CA207-Internals-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK.json new file mode 100644 index 0000000..1acc5e1 Binary files /dev/null and b/Config/2025.2.3/ConditionalAccess/CA207-Internals-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK.json differ diff --git a/Config/2025.2.3/ConditionalAccess/CA208-Internals-BaseProtection-AnyApp-MacOS-Compliant.json b/Config/2025.2.3/ConditionalAccess/CA208-Internals-BaseProtection-AnyApp-MacOS-Compliant.json new file mode 100644 index 0000000..f350a43 Binary files /dev/null and b/Config/2025.2.3/ConditionalAccess/CA208-Internals-BaseProtection-AnyApp-MacOS-Compliant.json differ diff --git a/Config/2025.2.3/ConditionalAccess/CA209-Internals-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation.json b/Config/2025.2.3/ConditionalAccess/CA209-Internals-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation.json new file mode 100644 index 0000000..8b8a057 Binary files /dev/null and b/Config/2025.2.3/ConditionalAccess/CA209-Internals-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation.json differ diff --git a/Config/2025.2.3/ConditionalAccess/CA210-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskSignIn.json b/Config/2025.2.3/ConditionalAccess/CA210-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskSignIn.json new file mode 100644 index 0000000..da4458d Binary files /dev/null and b/Config/2025.2.3/ConditionalAccess/CA210-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskSignIn.json differ diff --git a/Config/2025.2.3/ConditionalAccess/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA.json b/Config/2025.2.3/ConditionalAccess/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA.json new file mode 100644 index 0000000..32d08fa Binary files /dev/null and b/Config/2025.2.3/ConditionalAccess/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA.json differ diff --git a/Config/2025.2.3/ConditionalAccess/CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess.json b/Config/2025.2.3/ConditionalAccess/CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess.json new file mode 100644 index 0000000..ef03592 Binary files /dev/null and b/Config/2025.2.3/ConditionalAccess/CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess.json differ diff --git a/Config/2025.2.3/ConditionalAccess/CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json b/Config/2025.2.3/ConditionalAccess/CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json new file mode 100644 index 0000000..0b10619 Binary files /dev/null and b/Config/2025.2.3/ConditionalAccess/CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency.json differ diff --git a/Config/2025.2.3/ConditionalAccess/CA403-GuestUsers-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json b/Config/2025.2.3/ConditionalAccess/CA403-GuestUsers-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json new file mode 100644 index 0000000..a1f6b21 Binary files /dev/null and b/Config/2025.2.3/ConditionalAccess/CA403-GuestUsers-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser.json differ diff --git a/Config/2025.2.3/ConditionalAccess/CA404-GuestUsers-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK.json b/Config/2025.2.3/ConditionalAccess/CA404-GuestUsers-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK.json new file mode 100644 index 0000000..b0f7c66 Binary files /dev/null and b/Config/2025.2.3/ConditionalAccess/CA404-GuestUsers-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK.json differ diff --git a/Config/2025.2.3/Groups/APP_Microsoft365_E5.json b/Config/2025.2.3/Groups/APP_Microsoft365_E5.json new file mode 100644 index 0000000..8f0aad2 Binary files /dev/null and b/Config/2025.2.3/Groups/APP_Microsoft365_E5.json differ diff --git a/Config/2025.2.3/Groups/APP_Microsoft365_E5_Dev.json b/Config/2025.2.3/Groups/APP_Microsoft365_E5_Dev.json new file mode 100644 index 0000000..734d407 Binary files /dev/null and b/Config/2025.2.3/Groups/APP_Microsoft365_E5_Dev.json differ diff --git a/Config/2025.2.3/Groups/CA-BreakGlassAccounts - Exclude.json b/Config/2025.2.3/Groups/CA-BreakGlassAccounts - Exclude.json new file mode 100644 index 0000000..013e7b1 Binary files /dev/null and b/Config/2025.2.3/Groups/CA-BreakGlassAccounts - Exclude.json differ diff --git a/Config/2025.2.3/Groups/CA-Schipholborden - Exclude.json b/Config/2025.2.3/Groups/CA-Schipholborden - Exclude.json new file mode 100644 index 0000000..5f509b4 Binary files /dev/null and b/Config/2025.2.3/Groups/CA-Schipholborden - Exclude.json differ diff --git a/Config/2025.2.3/Groups/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json b/Config/2025.2.3/Groups/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json new file mode 100644 index 0000000..53b6472 Binary files /dev/null and b/Config/2025.2.3/Groups/CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json differ diff --git a/Config/2025.2.3/Groups/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist - Exclude.json b/Config/2025.2.3/Groups/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist - Exclude.json new file mode 100644 index 0000000..9ae132b Binary files /dev/null and b/Config/2025.2.3/Groups/CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist - Exclude.json differ diff --git a/Config/2025.2.3/Groups/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication - Exclude.json b/Config/2025.2.3/Groups/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication - Exclude.json new file mode 100644 index 0000000..8daa0a4 Binary files /dev/null and b/Config/2025.2.3/Groups/CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication - Exclude.json differ diff --git a/Config/2025.2.3/Groups/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA - Exclude.json b/Config/2025.2.3/Groups/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA - Exclude.json new file mode 100644 index 0000000..a41d980 Binary files /dev/null and b/Config/2025.2.3/Groups/CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA - Exclude.json differ diff --git a/Config/2025.2.3/Groups/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows - Exclude.json b/Config/2025.2.3/Groups/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows - Exclude.json new file mode 100644 index 0000000..3376792 Binary files /dev/null and b/Config/2025.2.3/Groups/CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows - Exclude.json differ diff --git a/Config/2025.2.3/Groups/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload - Exclude.json b/Config/2025.2.3/Groups/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload - Exclude.json new file mode 100644 index 0000000..f949fb2 Binary files /dev/null and b/Config/2025.2.3/Groups/CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload - Exclude.json differ diff --git a/Config/2025.2.3/Groups/CA006-Global-DataProtection-Office365-iOSenAndroid-RequireAppProtection - Exclude.json b/Config/2025.2.3/Groups/CA006-Global-DataProtection-Office365-iOSenAndroid-RequireAppProtection - Exclude.json new file mode 100644 index 0000000..ed0f7e3 Binary files /dev/null and b/Config/2025.2.3/Groups/CA006-Global-DataProtection-Office365-iOSenAndroid-RequireAppProtection - Exclude.json differ diff --git a/Config/2025.2.3/Groups/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json b/Config/2025.2.3/Groups/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json new file mode 100644 index 0000000..ef815df Binary files /dev/null and b/Config/2025.2.3/Groups/CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json differ diff --git a/Config/2025.2.3/Groups/CA103-Admins-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser - Exclude.json b/Config/2025.2.3/Groups/CA103-Admins-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser - Exclude.json new file mode 100644 index 0000000..d15c16a Binary files /dev/null and b/Config/2025.2.3/Groups/CA103-Admins-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser - Exclude.json differ diff --git a/Config/2025.2.3/Groups/CA104-Admins-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation - Exclude.json b/Config/2025.2.3/Groups/CA104-Admins-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation - Exclude.json new file mode 100644 index 0000000..09599f3 Binary files /dev/null and b/Config/2025.2.3/Groups/CA104-Admins-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation - Exclude.json differ diff --git a/Config/2025.2.3/Groups/CA105-Admins-IdentityProtection-AnyApp-AnyPlatform-PhishingResistantMFA - Exclude.json b/Config/2025.2.3/Groups/CA105-Admins-IdentityProtection-AnyApp-AnyPlatform-PhishingResistantMFA - Exclude.json new file mode 100644 index 0000000..7f22074 Binary files /dev/null and b/Config/2025.2.3/Groups/CA105-Admins-IdentityProtection-AnyApp-AnyPlatform-PhishingResistantMFA - Exclude.json differ diff --git a/Config/2025.2.3/Groups/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json b/Config/2025.2.3/Groups/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json new file mode 100644 index 0000000..78afa2e Binary files /dev/null and b/Config/2025.2.3/Groups/CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json differ diff --git a/Config/2025.2.3/Groups/CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskUser - Exclude.json b/Config/2025.2.3/Groups/CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskUser - Exclude.json new file mode 100644 index 0000000..6ce2aa4 Binary files /dev/null and b/Config/2025.2.3/Groups/CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskUser - Exclude.json differ diff --git a/Config/2025.2.3/Groups/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA - Exclude.json b/Config/2025.2.3/Groups/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA - Exclude.json new file mode 100644 index 0000000..330bf35 Binary files /dev/null and b/Config/2025.2.3/Groups/CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA - Exclude.json differ diff --git a/Config/2025.2.3/Groups/CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ - Exclude.json b/Config/2025.2.3/Groups/CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ - Exclude.json new file mode 100644 index 0000000..c197da1 Binary files /dev/null and b/Config/2025.2.3/Groups/CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ - Exclude.json differ diff --git a/Config/2025.2.3/Groups/CA206-Internals-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser - Exclude.json b/Config/2025.2.3/Groups/CA206-Internals-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser - Exclude.json new file mode 100644 index 0000000..65ebdfa Binary files /dev/null and b/Config/2025.2.3/Groups/CA206-Internals-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser - Exclude.json differ diff --git a/Config/2025.2.3/Groups/CA207-Internals-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK - Exclude.json b/Config/2025.2.3/Groups/CA207-Internals-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK - Exclude.json new file mode 100644 index 0000000..1374831 Binary files /dev/null and b/Config/2025.2.3/Groups/CA207-Internals-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK - Exclude.json differ diff --git a/Config/2025.2.3/Groups/CA208-Internals-BaseProtection-AnyApp-MacOS-Compliant - Exclude.json b/Config/2025.2.3/Groups/CA208-Internals-BaseProtection-AnyApp-MacOS-Compliant - Exclude.json new file mode 100644 index 0000000..d60849b Binary files /dev/null and b/Config/2025.2.3/Groups/CA208-Internals-BaseProtection-AnyApp-MacOS-Compliant - Exclude.json differ diff --git a/Config/2025.2.3/Groups/CA209-Internals-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation - Exclude.json b/Config/2025.2.3/Groups/CA209-Internals-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation - Exclude.json new file mode 100644 index 0000000..5c05c9c Binary files /dev/null and b/Config/2025.2.3/Groups/CA209-Internals-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation - Exclude.json differ diff --git a/Config/2025.2.3/Groups/CA210-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskSignIn - Exclude.json b/Config/2025.2.3/Groups/CA210-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskSignIn - Exclude.json new file mode 100644 index 0000000..7b66938 Binary files /dev/null and b/Config/2025.2.3/Groups/CA210-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskSignIn - Exclude.json differ diff --git a/Config/2025.2.3/Groups/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json b/Config/2025.2.3/Groups/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json new file mode 100644 index 0000000..dcceab2 Binary files /dev/null and b/Config/2025.2.3/Groups/CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude.json differ diff --git a/Config/2025.2.3/Groups/CA403-Guests-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser - Exclude.json b/Config/2025.2.3/Groups/CA403-Guests-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser - Exclude.json new file mode 100644 index 0000000..cb76cd8 Binary files /dev/null and b/Config/2025.2.3/Groups/CA403-Guests-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser - Exclude.json differ diff --git a/Config/2025.2.3/Groups/CA404-Guests-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK - Exclude.json b/Config/2025.2.3/Groups/CA404-Guests-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK - Exclude.json new file mode 100644 index 0000000..5f65285 Binary files /dev/null and b/Config/2025.2.3/Groups/CA404-Guests-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK - Exclude.json differ diff --git a/Config/2025.2.3/MigrationTable.json b/Config/2025.2.3/MigrationTable.json new file mode 100644 index 0000000..653bbf9 Binary files /dev/null and b/Config/2025.2.3/MigrationTable.json differ diff --git a/Config/2025.2.3/NamedLocations/ALLOWED COUNTRIES.json b/Config/2025.2.3/NamedLocations/ALLOWED COUNTRIES.json new file mode 100644 index 0000000..99306e7 Binary files /dev/null and b/Config/2025.2.3/NamedLocations/ALLOWED COUNTRIES.json differ diff --git a/Images/CA201.1.png b/Images/CA201.1.png new file mode 100644 index 0000000..89ecea3 Binary files /dev/null and b/Images/CA201.1.png differ diff --git a/Images/CA206.png b/Images/CA206.png deleted file mode 100644 index f0bc79e..0000000 Binary files a/Images/CA206.png and /dev/null differ diff --git a/Images/CA210.png b/Images/CA210.png new file mode 100644 index 0000000..257e1fb Binary files /dev/null and b/Images/CA210.png differ diff --git a/README.md b/README.md index 72a9972..a82b84a 100644 --- a/README.md +++ b/README.md @@ -16,6 +16,9 @@ This conditional access baseline is based on the Microsoft Conditional Access Ba - [Version history](#version-history) - [Changelog](#changelog) - [2024.6.1](#202461) + - [2025.2.1](#202521) + - [2025.2.2](#202522) + - [2025.2.3](#202523) - [Persona's](#personas) - [Global](#global) - [Admins](#admins) @@ -33,10 +36,10 @@ This conditional access baseline is based on the Microsoft Conditional Access Ba - [CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA](#ca101-admins-identityprotection-anyapp-anyplatform-mfa) - [CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency](#ca102-admins-identityprotection-allapps-anyplatform-signinfrequency) - [CA103-Admins-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser](#ca103-admins-identityprotection-allapps-anyplatform-persistentbrowser) - - [CA104-Admins-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation](#ca104-Admins-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation) - - [CA105-Admins-IdentityProtection-AnyApp-AnyPlatform-PhishingResistantMFA](#ca105-Admins-IdentityProtection-AnyApp-AnyPlatform-PhishingResistantMFA) + - [CA104-Admins-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation](#ca104-admins-identityprotection-allapps-anyplatform-continuousaccessevaluation) + - [CA105-Admins-IdentityProtection-AnyApp-AnyPlatform-PhishingResistantMFA](#ca105-admins-identityprotection-anyapp-anyplatform-phishingresistantmfa) - [CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA](#ca200-internals-identityprotection-anyapp-anyplatform-mfa) - - [CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRisk](#ca201-internals-identityprotection-anyapp-anyplatform-block-highrisk) + - [CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskUser](#ca201-internals-identityprotection-anyapp-anyplatform-block-highriskuser) - [CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices](#ca202-internals-identityprotection-allapps-windowsmacos-signinfrequency-unmanageddevices) - [CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA](#ca203-internals-appprotection-microsoftintuneenrollment-anyplatform-mfa) - [CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms](#ca204-internals-attacksurfacereduction-allapps-anyplatform-blockunknownplatforms) @@ -44,7 +47,8 @@ This conditional access baseline is based on the Microsoft Conditional Access Ba - [CA206-Internals-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser](#ca206-internals-identityprotection-allapps-anyplatform-persistentbrowser) - [CA207-Internals-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK](#ca207-internals-attacksurfacereduction-selectedapps-anyplatform-block) - [CA208-Internals-BaseProtection-AnyApp-MacOS-Compliant](#ca208-internals-baseprotection-anyapp-macos-compliant) - - [CA209-Internals-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation](#ca209-Internals-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation) + - [CA209-Internals-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation](#ca209-internals-identityprotection-allapps-anyplatform-continuousaccessevaluation) + - [CA210-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskSignIn](#ca210-internals-identityprotection-anyapp-anyplatform-block-highrisksignin) - [CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA](#ca400-guestusers-identityprotection-anyapp-anyplatform-mfa) - [CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess](#ca401-guestusers-attacksurfacereduction-allapps-anyplatform-blocknonguestappaccess) - [CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency](#ca402-guestusers-identityprotection-allapps-anyplatform-signinfrequency) @@ -73,6 +77,8 @@ This conditional access baseline is based on the Microsoft Conditional Access Ba | 2024.4.1 | Released 10-04-2024 | | 2024.6.1 | Released 26-06-2024 | | 2025.2.1 | Released 01-02-2025 | +| 2025.2.2 | Released 06-02-2025 | +| 2025.2.3 | Released 13-02-2025 | ## Changelog @@ -92,6 +98,13 @@ This conditional access baseline is based on the Microsoft Conditional Access Ba * CA105: Added Phishing Resistant MFA for admins * CA209: Added Continuous Access Evaluation for internals +### 2025.2.2 +* CA206: Wrong exclusion group was assigned. Has been fixed. + +### 2025.2.3 +* CA201: Policy contained Signin Risk and User Risk in a single policy. Now separated into CA201 and CA210 +* CA210: Separated (new) policy for Signin Risk) + ## Persona's #### Global @@ -218,14 +231,14 @@ This policy requires MFA for all internal identities, for all cloud applications ![CA200](./Images/CA200.png) -### CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRisk +### CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskUser -This policy blocks all internal users which have a **high risk** (sign-in and user risk) status, to all cloud apps, from all platforms. +This policy blocks all internal users which have a **high risk** (user risk) status, to all cloud apps, from all platforms. > [!IMPORTANT] > Verify the included group(s) and/or add your custom groups which have all internals in it. APP_Microsoft365_E5 is added as an example. -![CA201](./Images/CA201.png) +![CA201](./Images/CA201.1.png) ### CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices @@ -302,6 +315,15 @@ This policy allows Microsoft Entra ID to re-evaluate a user's access to resource ![CA209](./Images/CA209.png) +### CA210-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskSignIn + +This policy blocks all internal users which have a **high risk** (Sign-in risk) status, to all cloud apps, from all platforms. + +> [!IMPORTANT] +> Verify the included group(s) and/or add your custom groups which have all internals in it. APP_Microsoft365_E5 is added as an example. + +![CA210](./Images/CA210.png) + ### CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA This policy requires guest to use MFA, from any platform when accessing any cloud app.