cis-azure-foundations-5-2-2

name	cis-azure-foundations-5.2.2
description	Ensure an exclusionary geographic Conditional Access policy is considered
category	cis-azure-foundations
version	5.0.0
author	cyberstrike-official
tags	["cis","azure","identity","conditional-access"]
cis_id	5.2.2
cis_benchmark	CIS Microsoft Azure Foundations Benchmark v5.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	["cis-azure-foundations-5.2.1","cis-azure-foundations-5.2.3"]
prerequisites	[]
severity_boost	{}

Ensure an exclusionary geographic Conditional Access policy is considered

Description

CAUTION: If these policies are created without first auditing and testing the result, misconfiguration can potentially lock out administrators or create undesired access issues.

Conditional Access Policies can be used to block access from geographic locations that are deemed out-of-scope for your organization or application. The scope and variables for this policy should be carefully examined and defined.

Rationale

Conditional Access, when used as a deny list for the tenant or subscription, is able to prevent ingress or egress of traffic to countries that are outside of the scope of interest (e.g.: customers, suppliers) or jurisdiction of an organization. This is an effective way to prevent unnecessary and long-lasting exposure to international threats such as APTs.

Note on Assessment Status: Because the determination of entities to be included or excluded is specific and unique to each organization, assessment status for this recommendation is considered 'Manual' even though some elements for automation (CLI, PowerShell) are provided.

Impact

Microsoft Entra ID P1 or P2 is required. Limiting access geographically will deny access to users that are traveling or working remotely in a different part of the world. A point-to-site or site to site tunnel such as a VPN is recommended to address exceptions to geographic access policies.

Audit Procedure

Using Azure Portal

1. From Azure Home open the Portal menu in the top left, and select Microsoft Entra ID.
2. Scroll down in the menu on the left, and select Security.
3. Select on the left side Conditional Access.
4. Select Policies.
5. Select the policy you wish to audit, then:
   • Under Assignments > Users, review the users and groups for the personnel the policy will apply to.
   • Under Assignments > Target resources, review the cloud apps or actions for the systems the policy will apply to.
   • Under Conditions > Locations, Review the Include locations for those that should be blocked.
   • Under Conditions > Locations, Review the Exclude locations for those that should be allowed (Note: locations set up in the previous recommendation for Trusted Location should be in the Exclude list.)