Block

CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist

Block access

About this policy

The CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist policy blocks sign-ins to every cloud app from any location, with the idea that you exclude a named location containing the countries you actually operate in. Once imported, add your own country whitelist to the location exclusions, otherwise the policy would block everyone. It is a simple way to cut out a huge amount of noise from regions your business never touches, and a few exclusion groups cover accounts that genuinely need to sign in from elsewhere.

Policy conditions

Users: All users
Apps: All cloud apps

JSON template

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies/$entity",
  "@odata.type": "#microsoft.graph.conditionalAccessPolicy",
  "@odata.id": "identity/conditionalAccess/policies('19bbdbd4-d871-4964-a6ef-9b3054b9337c')",
  "@odata.editLink": "identity/conditionalAccess/policies('19bbdbd4-d871-4964-a6ef-9b3054b9337c')",
  "templateId": null,
  "displayName": "CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist",
  "createdDateTime@odata.type": "#DateTimeOffset",
  "modifiedDateTime@odata.type": "#DateTimeOffset",
  "state@odata.type": "#microsoft.graph.conditionalAccessPolicyState",
  "state": "enabled",
  "deletedDateTime": null,
  "partialEnablementStrategy": null,
  "sessionControls": null,
  "conditions": {
    "@odata.type": "#microsoft.graph.conditionalAccessConditionSet",
    "userRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
    "userRiskLevels": [],
    "signInRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
    "signInRiskLevels": [],
    "clientAppTypes@odata.type": "#Collection(microsoft.graph.conditionalAccessClientApp)",
    "clientAppTypes": [
      "all"
    ],
    "platforms": null,
    "times": null,
    "deviceStates": null,
    "devices": null,
    "clientApplications": null,
    "agents": null,
    "applications": {
      "@odata.type": "#microsoft.graph.conditionalAccessApplications",
      "includeApplications@odata.type": "#Collection(String)",
      "includeApplications": [
        "All"
      ],
      "excludeApplications@odata.type": "#Collection(String)",
      "excludeApplications": [],
      "includeUserActions@odata.type": "#Collection(String)",
      "includeUserActions": [],
      "includeAuthenticationContextClassReferences@odata.type": "#Collection(String)",
      "includeAuthenticationContextClassReferences": [],
      "applicationFilter": null
    },
    "users": {
      "@odata.type": "#microsoft.graph.conditionalAccessUsers",
      "includeUsers@odata.type": "#Collection(String)",
      "includeUsers": [
        "All"
      ],
      "excludeUsers@odata.type": "#Collection(String)",
      "excludeUsers": [],
      "includeGroups@odata.type": "#Collection(String)",
      "includeGroups": [],
      "excludeGroups@odata.type": "#Collection(String)",
      "excludeGroups": [
        "6499f521-8620-4f4e-92a1-db47c79362e8",
        "2802b872-ccfb-4b29-a9a9-459808dfb11b",
        "813e2655-e8b9-4255-91f5-7761ee2824bb"
      ],
      "includeRoles@odata.type": "#Collection(String)",
      "includeRoles": [],
      "excludeRoles@odata.type": "#Collection(String)",
      "excludeRoles": [],
      "includeGuestsOrExternalUsers": null,
      "excludeGuestsOrExternalUsers": null
    },
    "locations": {
      "@odata.type": "#microsoft.graph.conditionalAccessLocations",
      "includeLocations@odata.type": "#Collection(String)",
      "includeLocations": [
        "All"
      ],
      "excludeLocations@odata.type": "#Collection(String)",
      "excludeLocations": []
    }
  },
  "grantControls": {
    "@odata.type": "#microsoft.graph.conditionalAccessGrantControls",
    "operator": "OR",
    "builtInControls@odata.type": "#Collection(microsoft.graph.conditionalAccessGrantControl)",
    "builtInControls": [
      "block"
    ],
    "customAuthenticationFactors@odata.type": "#Collection(String)",
    "customAuthenticationFactors": [],
    "termsOfUse@odata.type": "#Collection(String)",
    "termsOfUse": [],
    "authenticationStrength@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies('19bbdbd4-d871-4964-a6ef-9b3054b9337c')/grantControls/authenticationStrength/$entity",
    "authenticationStrength@odata.associationLink": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('19bbdbd4-d871-4964-a6ef-9b3054b9337c')/grantControls/authenticationStrength/$ref",
    "authenticationStrength@odata.navigationLink": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('19bbdbd4-d871-4964-a6ef-9b3054b9337c')/grantControls/authenticationStrength",
    "authenticationStrength": null
  },
  "#microsoft.graph.restore": {
    "title": "microsoft.graph.restore",
    "target": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('19bbdbd4-d871-4964-a6ef-9b3054b9337c')/microsoft.graph.restore"
  },
  "Tag": "jv-CAF-2026.2.1",
  "summary": "The CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist policy blocks sign-ins to every cloud app from any location, with the idea that you exclude a named location containing the countries you actually operate in. Once imported, add your own country whitelist to the location exclusions, otherwise the policy would block everyone. It is a simple way to cut out a huge amount of noise from regions your business never touches, and a few exclusion groups cover accounts that genuinely need to sign in from elsewhere."
}