6.0 KiB
Conditional access Baselne
This conditional access baseline is based on the Microsoft Conditional Access Baseline by Claus Jespersen. This one is slightly minimized and less dificult to understand but still protects almost everything you could wish for. Use this baseline to start off with and expend or modify where needed.
Note
There's no need to create policies, groups or named locations yourself. This can be done automated using Mick-K his Intune Management tool. This is described in Importing the baseline.
Table of Contents
- Conditional access Baselne
- Table of Contents
- Resources
- Version history
- Changelog
- Conditional access policies
- CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA
- CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA
- CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist
- CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication
- CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA
- CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows
- CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload
- CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA
- CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA
- CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency
- CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA
- CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRisk
- CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices
- CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA
- CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms
- CA205-Internals-IdentityProtection-AllApps-AnyPlatform-CombinedRegistration
- CA206-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ
- CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA
- CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess
- CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency
- Named locations
- Importing the baseline
Resources
➡ Microsoft Learn: https://learn.microsoft.com/en-us/azure/architecture/guide/security/conditional-access-framework
➡ Framework documentation by Claus Jespersen: https://github.com/microsoft/ConditionalAccessforZeroTrustResources/blob/main/ConditionalAccessGovernanceAndPrinciplesforZeroTrust%20October%202023.pdf
➡ Framework resources: https://github.com/microsoft/ConditionalAccessforZeroTrustResources
Version history
| Version nr | Release date |
|---|---|
| 2024.4.1 | Released 10-04-2024 |
| 2024.x.x | Released xx-xx-2024 |
Changelog
Changes are documented here once they are made.