Description:
An exclusionary geographic access policy restricts user sign-ins from countries or regions where the organization does not operate. Implementing such a policy reduces the risk of unauthorized access from high-risk locations, supports regulatory compliance, and strengthens the organization’s overall security posture.
Rationale:
Blocking access from selected geographic locations reduces the risk of account compromise by preventing sign-in attempts from high-risk regions, strengthens identity security, limits exposure to cyber threats, and supports enforcement of location-based access controls for sensitive resources.
Impact:
Users attempting to sign in from blocked geographic locations will be denied access. Legitimate users traveling or working remotely may require a VPN or approved alternate access. While this may introduce limited user inconvenience, it significantly reduces the risk of unauthorized access from high-risk regions.
Pre-requisites:
Global Administrator or Security Administrator access to Microsoft Entra ID
Defined list of blocked countries or regions
Test Plan:
Sign in to the Azure Portal at https://portal.azure.com
Search for Microsoft Entra ID and open it
Under the Manage section, select Security
Under the Protect, Open Conditional Access
Select Policies
Review existing policies
Verify a Conditional Access policy exists with Locations configured to block selected countries or regions
If an exclusionary geographic access policy is not present, follow the implementation steps
Implementation Steps:
Sign in to the Azure Portal at https://portal.azure.com
Search for Microsoft Entra ID and open it
Under the Manage section, select Security
Under the protect, Open Conditional Access and Select Policies
Select Create new policy, Configure policy conditions to block selected countries or regions
Configure access controls to block access and enable the policy
Create and save the policy
Backup:
Sign in to the Azure Portal at https://portal.azure.com
Search for Microsoft Entra ID and open it
Under the Manage section, select Security
Open Conditional Access
Select Policies
Select the exclusionary geographic access policy
Disable the policy or delete the policy
Save the changes
Reference:


