# Ensure that an exclusionary Geographic Access Policy is considered

- Source: https://support.icompaas.com/support/solutions/articles/62000229782-ensure-that-an-exclusionary-geographic-access-policy-is-considered
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [General](https://support.icompaas.com/support/solutions/62000037933) › [Azure Compliance / Control / Check](https://support.icompaas.com/support/solutions/folders/62000168797)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## Description:

An exclusionary geographic access policy restricts user sign-ins from countries or regions where the organization does not operate. Implementing such a policy reduces the risk of unauthorized access from high-risk locations, supports regulatory compliance, and strengthens the organization’s overall security posture.

  

Rationale:

Blocking access from selected geographic locations reduces the risk of account compromise by preventing sign-in attempts from high-risk regions, strengthens identity security, limits exposure to cyber threats, and supports enforcement of location-based access controls for sensitive resources.

  

Impact:

Users attempting to sign in from blocked geographic locations will be denied access. Legitimate users traveling or working remotely may require a VPN or approved alternate access. While this may introduce limited user inconvenience, it significantly reduces the risk of unauthorized access from high-risk regions.

  

Pre-requisites:

-   Global Administrator or Security Administrator access to Microsoft Entra ID
    
-   Defined list of blocked countries or regions  
      
    

Test Plan:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Search for Microsoft Entra ID and open it
    
3.  Under the Manage section, select Security
    
4.  Under the Protect, Open Conditional Access
    
5.  Select Policies
    
6.  Review existing policies
    
7.  Verify a Conditional Access policy exists with Locations configured to block selected countries or regions
    
8.  If an exclusionary geographic access policy is not present, follow the implementation steps
    

  

Implementation Steps:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Search for Microsoft Entra ID and open it
    
3.  Under the Manage section, select Security
    

                                   ![](https://support.icompaas.com/assets/kb/677478f16b01e889.png)

4.  Under the protect, Open Conditional Access and Select Policies
    

                              ![](https://support.icompaas.com/assets/kb/f6aa2dcb6d54d5de.png)

5.  Select Create new policy, Configure policy conditions to block selected countries or regions
    

                ![](https://support.icompaas.com/assets/kb/29d41656bb770b26.png)

6.  Configure access controls to block access and enable the policy
    
7.  Create and save the policy
    

Backup:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Search for Microsoft Entra ID and open it
    
3.  Under the Manage section, select Security
    
4.  Open Conditional Access
    
5.  Select Policies
    
6.  Select the exclusionary geographic access policy
    
7.  Disable the policy or delete the policy
    
8.  Save the changes
    

  

Reference:

-   [https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition)
    
-   [https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users)
    
-   [https://learn.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-identity-management](https://learn.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-identity-management)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.