Policy: Azure > CIS v2.0 > 01 - Identity and Access Management > 1.02 - Conditional Access > 1.02.02 - Ensure that an exclusionary Geographic Access Policy is considered > Attestation

From Azure Portal

Part 1 of 2 - Create the policy and enable it in Report-only mode. 1. From Azure Home open the portal menu in the top left, and select Azure Active Directory. 2. Scroll down in the menu on the left, and select Security. 3. Select on the left side Conditional Access. 4. Click the + New policy button, then: 5. Provide a name for the policy. 6. Under Assignments, select Users or workload identities then: o Under Include, select All users o Under Exclude, check Users and groups and only select emergency access accounts and service accounts (NOTE: Service accounts are excluded here because service accounts are non-interactive and cannot complete MFA) 7. Under Assignments, select Cloud apps or actions then: o Under Include, select All cloud apps o Leave Exclude blank unless you have a well defined exception 8. Under Conditions, select Locations then: o Select Include, then add entries for locations for those that should be blocked o Select Exclude, then add entries for those that should be allowed (IMPORTANT: Ensure that all Trusted Locations are in the Exclude list.) 9. Under Access Controls, select Grant and Confirm that Block Access is selected. 10.Set Enable policy to Report-only. 11.Click Create.

NOTE: The policy is not yet 'live,' since Report-only is being used to audit the effect of the policy. Part 2 of 2 - Confirm that the policy is not blocking access that should be granted, then toggle to On. 1. With your policy now in report-only mode, return to the Azure Active Directory blade and click on Sign-in logs. 2. Review the recent sign-in events - click an event then review the event details (specifically the Report-only tab) to ensure: o The sign-in event you're reviewing occurred after turning on the policy in report-only mode o The policy name from step 5 above is listed in the Policy Name column o The Result column for the new policy shows that the policy was Not applied (indicating the location origin was not blocked) 3. If the above conditions are present, navigate back to the policy name in Conditional Access and open it. 4. Toggle the policy from Report-only to On. 5. Click Save.

Once verified, enter the date that this attestation expires. Note that the date can not be further in the future than is specified in report level Maximum Attestation Duration policy. Set to a blank value to clear the attestation.