Session Control

CA104-Admins-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation

Session controls

About this policy

The CA104-Admins-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation policy enables continuous access evaluation in strict location mode for a set of privileged roles. Rather than waiting for a token to expire, supported services check in near real time and can cut a session the moment something changes, such as an admin appearing from an IP address outside your defined locations. Make sure your named locations cover every legitimate admin network first, as strict mode will happily block traffic from anywhere it does not recognise.

Policy conditions

Users: Specific users
Apps: All cloud apps

JSON template

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies/$entity",
  "templateId": null,
  "displayName": "CA104-Admins-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation",
  "modifiedDateTime": null,
  "state": "disabled",
  "deletedDateTime": null,
  "grantControls": null,
  "partialEnablementStrategy": null,
  "conditions": {
    "userRiskLevels": [],
    "signInRiskLevels": [],
    "clientAppTypes": [
      "all"
    ],
    "platforms": null,
    "locations": null,
    "times": null,
    "deviceStates": null,
    "devices": null,
    "clientApplications": null,
    "agents": null,
    "applications": {
      "includeApplications": [
        "All"
      ],
      "excludeApplications": [],
      "includeUserActions": [],
      "includeAuthenticationContextClassReferences": [],
      "applicationFilter": null
    },
    "users": {
      "includeUsers": [],
      "excludeUsers": [],
      "includeGroups": [],
      "excludeGroups": [],
      "includeRoles": [
        "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3",
        "c4e39bd9-1100-46d3-8c65-fb160da0071f",
        "b0f54661-2d74-4c50-afa3-1ec803f12efe",
        "158c047a-c907-4556-b7ef-446551a6b5f7",
        "b1be1c3e-b65d-4f19-8427-f6fa0d97feb9",
        "29232cdf-9323-42fd-ade2-1d097af3e4de",
        "62e90394-69f5-4237-9190-012177145e10",
        "f2ef992c-3afb-46b9-b7cf-a126ee74c451",
        "729827e3-9c14-49f7-bb1b-9608f156bbb8",
        "3a2c62db-5318-420d-8d74-23affee5d9d5",
        "966707d0-3269-4727-9be2-8c3a10f19b9d",
        "7be44c8a-adaf-4e2a-84d6-ab2649e08a13"
      ],
      "excludeRoles": [],
      "includeGuestsOrExternalUsers": null,
      "excludeGuestsOrExternalUsers": null
    }
  },
  "sessionControls": {
    "disableResilienceDefaults": null,
    "applicationEnforcedRestrictions": null,
    "cloudAppSecurity": null,
    "signInFrequency": null,
    "persistentBrowser": null,
    "secureSignInSession": null,
    "blockSensitiveActions": null,
    "continuousAccessEvaluation": {
      "mode": "strictLocation"
    }
  },
  "summary": "The CA104-Admins-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation policy enables continuous access evaluation in strict location mode for a set of privileged roles. Rather than waiting for a token to expire, supported services check in near real time and can cut a session the moment something changes, such as an admin appearing from an IP address outside your defined locations. Make sure your named locations cover every legitimate admin network first, as strict mode will happily block traffic from anywhere it does not recognise."
}