{
  "_readme": {
    "source": "https://soliman.co.uk/insights/conditional-access-policy-library/",
    "licence": "Free to use and modify. No warranty. Test in report-only mode first.",
    "replace_before_import": {
      "<BREAK-GLASS-GROUP-ID>": "Object id of the group containing your two break-glass accounts",
      "<SERVICE-ACCOUNTS-GROUP-ID>": "Group of accounts that cannot do MFA (review quarterly)",
      "<TRAVEL-EXCEPTIONS-GROUP-ID>": "Group for staff travelling to blocked countries",
      "<BLOCKED-COUNTRIES-NAMED-LOCATION-ID>": "Named location id (Entra > Protection > Conditional Access > Named locations)"
    },
    "notes": "CA007 also needs a companion guest MFA policy if you rely on guest access; CA008 requires Entra ID P2; CA002 uses the built-in 'Phishing-resistant MFA' authentication strength id."
  },
  "policies": [
    {
      "displayName": "CA001-AllUsers-AllApps-LegacyAuth-Block",
      "state": "enabledForReportingButNotEnforced",
      "conditions": {
        "users": {
          "includeUsers": [
            "All"
          ],
          "excludeGroups": [
            "<BREAK-GLASS-GROUP-ID>"
          ]
        },
        "applications": {
          "includeApplications": [
            "All"
          ]
        },
        "clientAppTypes": [
          "exchangeActiveSync",
          "other"
        ]
      },
      "grantControls": {
        "operator": "OR",
        "builtInControls": [
          "block"
        ]
      }
    },
    {
      "displayName": "CA002-Admins-AllApps-AnyPlatform-PhishingResistantMFA",
      "state": "enabledForReportingButNotEnforced",
      "conditions": {
        "users": {
          "includeRoles": [
            "62e90394-69f5-4237-9190-012177145e10",
            "194ae4cb-b126-40b2-bd5b-6091b380977d",
            "f28a1f50-f6e7-4571-818b-6a12f2af6b6c",
            "29232cdf-9323-42fd-ade2-1d097af3e4de",
            "b1be1c3e-b65d-4f19-8427-f6fa0d97feb9",
            "729827e3-9c14-49f7-bb1b-9608f156bbb8",
            "b0f54661-2d74-4c50-afa3-1ec803f12efe",
            "fe930be7-5e62-47db-91af-98c3a49a38b1",
            "c4e39bd9-1100-46d3-8c65-fb160da0071f",
            "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3",
            "158c047a-c907-4556-b7ef-446551a6b5f7",
            "966707d0-3269-4727-9be2-8c3a10f19b9d",
            "7be44c8a-adaf-4e2a-84d6-ab2649e08a13",
            "e8611ab8-c189-46e8-94e1-60213ab1f814"
          ],
          "excludeGroups": [
            "<BREAK-GLASS-GROUP-ID>"
          ]
        },
        "applications": {
          "includeApplications": [
            "All"
          ]
        },
        "clientAppTypes": [
          "all"
        ]
      },
      "grantControls": {
        "operator": "OR",
        "authenticationStrength": {
          "id": "00000000-0000-0000-0000-000000000004"
        }
      }
    },
    {
      "displayName": "CA003-AllUsers-AllApps-AnyPlatform-RequireMFA",
      "state": "enabledForReportingButNotEnforced",
      "conditions": {
        "users": {
          "includeUsers": [
            "All"
          ],
          "excludeGroups": [
            "<BREAK-GLASS-GROUP-ID>",
            "<SERVICE-ACCOUNTS-GROUP-ID>"
          ]
        },
        "applications": {
          "includeApplications": [
            "All"
          ]
        },
        "clientAppTypes": [
          "all"
        ]
      },
      "grantControls": {
        "operator": "OR",
        "builtInControls": [
          "mfa"
        ]
      }
    },
    {
      "displayName": "CA004-AllUsers-M365-AnyPlatform-RequireCompliantDevice",
      "state": "enabledForReportingButNotEnforced",
      "conditions": {
        "users": {
          "includeUsers": [
            "All"
          ],
          "excludeGroups": [
            "<BREAK-GLASS-GROUP-ID>"
          ]
        },
        "applications": {
          "includeApplications": [
            "Office365"
          ]
        },
        "clientAppTypes": [
          "all"
        ]
      },
      "grantControls": {
        "operator": "OR",
        "builtInControls": [
          "compliantDevice",
          "domainJoinedDevice"
        ]
      }
    },
    {
      "displayName": "CA005-AllUsers-AllApps-UnsupportedPlatforms-Block",
      "state": "enabledForReportingButNotEnforced",
      "conditions": {
        "users": {
          "includeUsers": [
            "All"
          ],
          "excludeGroups": [
            "<BREAK-GLASS-GROUP-ID>"
          ]
        },
        "applications": {
          "includeApplications": [
            "All"
          ]
        },
        "clientAppTypes": [
          "all"
        ],
        "platforms": {
          "includePlatforms": [
            "all"
          ],
          "excludePlatforms": [
            "android",
            "iOS",
            "windows",
            "macOS"
          ]
        }
      },
      "grantControls": {
        "operator": "OR",
        "builtInControls": [
          "block"
        ]
      }
    },
    {
      "displayName": "CA006-AllUsers-AdminPortals-AnyPlatform-RequireMFA",
      "state": "enabledForReportingButNotEnforced",
      "conditions": {
        "users": {
          "includeUsers": [
            "All"
          ],
          "excludeGroups": [
            "<BREAK-GLASS-GROUP-ID>"
          ]
        },
        "applications": {
          "includeApplications": [
            "MicrosoftAdminPortals"
          ]
        },
        "clientAppTypes": [
          "all"
        ]
      },
      "grantControls": {
        "operator": "OR",
        "builtInControls": [
          "mfa"
        ]
      },
      "sessionControls": {
        "signInFrequency": {
          "value": 1,
          "type": "hours",
          "isEnabled": true
        }
      }
    },
    {
      "displayName": "CA007-Guests-AllApps-AnyPlatform-MFA-LimitedApps",
      "state": "enabledForReportingButNotEnforced",
      "conditions": {
        "users": {
          "includeGuestsOrExternalUsers": {
            "guestOrExternalUserTypes": "internalGuest,b2bCollaborationGuest,b2bCollaborationMember,b2bDirectConnectUser,otherExternalUser,serviceProvider",
            "externalTenants": {
              "membershipKind": "all"
            }
          }
        },
        "applications": {
          "includeApplications": [
            "All"
          ],
          "excludeApplications": [
            "Office365"
          ]
        },
        "clientAppTypes": [
          "all"
        ]
      },
      "grantControls": {
        "operator": "OR",
        "builtInControls": [
          "block"
        ]
      }
    },
    {
      "displayName": "CA008-AllUsers-AllApps-HighRisk-Block",
      "state": "enabledForReportingButNotEnforced",
      "conditions": {
        "users": {
          "includeUsers": [
            "All"
          ],
          "excludeGroups": [
            "<BREAK-GLASS-GROUP-ID>"
          ]
        },
        "applications": {
          "includeApplications": [
            "All"
          ]
        },
        "clientAppTypes": [
          "all"
        ],
        "signInRiskLevels": [
          "high"
        ],
        "userRiskLevels": [
          "high"
        ]
      },
      "grantControls": {
        "operator": "OR",
        "builtInControls": [
          "block"
        ]
      }
    },
    {
      "displayName": "CA009-AllUsers-AllApps-BlockedCountries-Block",
      "state": "enabledForReportingButNotEnforced",
      "conditions": {
        "users": {
          "includeUsers": [
            "All"
          ],
          "excludeGroups": [
            "<BREAK-GLASS-GROUP-ID>",
            "<TRAVEL-EXCEPTIONS-GROUP-ID>"
          ]
        },
        "applications": {
          "includeApplications": [
            "All"
          ]
        },
        "clientAppTypes": [
          "all"
        ],
        "locations": {
          "includeLocations": [
            "<BLOCKED-COUNTRIES-NAMED-LOCATION-ID>"
          ]
        }
      },
      "grantControls": {
        "operator": "OR",
        "builtInControls": [
          "block"
        ]
      }
    },
    {
      "displayName": "CA010-AllUsers-M365-UnmanagedDevice-BrowserOnly",
      "state": "enabledForReportingButNotEnforced",
      "conditions": {
        "users": {
          "includeUsers": [
            "All"
          ],
          "excludeGroups": [
            "<BREAK-GLASS-GROUP-ID>"
          ]
        },
        "applications": {
          "includeApplications": [
            "Office365"
          ]
        },
        "clientAppTypes": [
          "browser"
        ]
      },
      "sessionControls": {
        "applicationEnforcedRestrictions": {
          "isEnabled": true
        }
      }
    }
  ]
}