Session Control

CA209-Internals-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation

Session controls

About this policy

The CA209-Internals-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation policy turns on continuous access evaluation in strict location mode for all users across all cloud apps. Supported services then enforce your named location boundaries in near real time, killing sessions when a token turns up from an IP address outside the locations you have defined. It is powerful, but do the groundwork first, every legitimate network your users appear from needs to be captured in named locations, or you will be fielding some confused support calls.

Policy conditions

Users: All users
Apps: All cloud apps

JSON template

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies/$entity",
  "templateId": null,
  "displayName": "CA209-Internals-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation",
  "modifiedDateTime": null,
  "state": "disabled",
  "deletedDateTime": null,
  "grantControls": null,
  "partialEnablementStrategy": null,
  "conditions": {
    "userRiskLevels": [],
    "signInRiskLevels": [],
    "clientAppTypes": [
      "all"
    ],
    "platforms": null,
    "locations": null,
    "times": null,
    "deviceStates": null,
    "devices": null,
    "clientApplications": null,
    "agents": null,
    "applications": {
      "includeApplications": [
        "All"
      ],
      "excludeApplications": [],
      "includeUserActions": [],
      "includeAuthenticationContextClassReferences": [],
      "applicationFilter": null
    },
    "users": {
      "includeUsers": [
        "All"
      ],
      "excludeUsers": [],
      "includeGroups": [],
      "excludeGroups": [],
      "includeRoles": [],
      "excludeRoles": [],
      "includeGuestsOrExternalUsers": null,
      "excludeGuestsOrExternalUsers": null
    }
  },
  "sessionControls": {
    "disableResilienceDefaults": null,
    "applicationEnforcedRestrictions": null,
    "cloudAppSecurity": null,
    "signInFrequency": null,
    "persistentBrowser": null,
    "secureSignInSession": null,
    "blockSensitiveActions": null,
    "continuousAccessEvaluation": {
      "mode": "strictLocation"
    }
  },
  "summary": "The CA209-Internals-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation policy turns on continuous access evaluation in strict location mode for all users across all cloud apps. Supported services then enforce your named location boundaries in near real time, killing sessions when a token turns up from an IP address outside the locations you have defined. It is powerful, but do the groundwork first, every legitimate network your users appear from needs to be captured in named locations, or you will be fielding some confused support calls."
}