Block

CA301-ServiceAccounts-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUntrustedLocations

Block access

About this policy

The CA301-ServiceAccounts-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUntrustedLocations policy blocks your service accounts group from signing in from any location, with the intention that you exclude your trusted named locations after import. Service accounts tend to have predictable homes, a couple of servers or offices, so anything outside those is almost certainly trouble. Populate the location exclusions with your known networks before enabling it, then anything appearing from an unexpected IP address gets stopped at the door.

Policy conditions

Users: Specific users
Apps: All cloud apps

JSON template

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies/$entity",
  "@odata.type": "#microsoft.graph.conditionalAccessPolicy",
  "@odata.id": "identity/conditionalAccess/policies('ff0b4179-d1e7-41b4-aaeb-7c8ef89048d2')",
  "@odata.editLink": "identity/conditionalAccess/policies('ff0b4179-d1e7-41b4-aaeb-7c8ef89048d2')",
  "templateId": null,
  "displayName": "CA301-ServiceAccounts-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUntrustedLocations",
  "createdDateTime@odata.type": "#DateTimeOffset",
  "modifiedDateTime@odata.type": "#DateTimeOffset",
  "state@odata.type": "#microsoft.graph.conditionalAccessPolicyState",
  "state": "enabled",
  "deletedDateTime": null,
  "partialEnablementStrategy": null,
  "sessionControls": null,
  "conditions": {
    "@odata.type": "#microsoft.graph.conditionalAccessConditionSet",
    "userRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
    "userRiskLevels": [],
    "signInRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
    "signInRiskLevels": [],
    "clientAppTypes@odata.type": "#Collection(microsoft.graph.conditionalAccessClientApp)",
    "clientAppTypes": [
      "all"
    ],
    "platforms": null,
    "times": null,
    "deviceStates": null,
    "devices": null,
    "clientApplications": null,
    "agents": null,
    "applications": {
      "@odata.type": "#microsoft.graph.conditionalAccessApplications",
      "includeApplications@odata.type": "#Collection(String)",
      "includeApplications": [
        "All"
      ],
      "excludeApplications@odata.type": "#Collection(String)",
      "excludeApplications": [],
      "includeUserActions@odata.type": "#Collection(String)",
      "includeUserActions": [],
      "includeAuthenticationContextClassReferences@odata.type": "#Collection(String)",
      "includeAuthenticationContextClassReferences": [],
      "applicationFilter": null
    },
    "users": {
      "@odata.type": "#microsoft.graph.conditionalAccessUsers",
      "includeUsers@odata.type": "#Collection(String)",
      "includeUsers": [],
      "excludeUsers@odata.type": "#Collection(String)",
      "excludeUsers": [],
      "includeGroups@odata.type": "#Collection(String)",
      "includeGroups": [
        "77c1ed37-10d0-4ef1-93dc-198e70abb166"
      ],
      "excludeGroups@odata.type": "#Collection(String)",
      "excludeGroups": [
        "813e2655-e8b9-4255-91f5-7761ee2824bb"
      ],
      "includeRoles@odata.type": "#Collection(String)",
      "includeRoles": [],
      "excludeRoles@odata.type": "#Collection(String)",
      "excludeRoles": [],
      "includeGuestsOrExternalUsers": null,
      "excludeGuestsOrExternalUsers": null
    },
    "locations": {
      "@odata.type": "#microsoft.graph.conditionalAccessLocations",
      "includeLocations@odata.type": "#Collection(String)",
      "includeLocations": [
        "All"
      ],
      "excludeLocations@odata.type": "#Collection(String)",
      "excludeLocations": []
    }
  },
  "grantControls": {
    "@odata.type": "#microsoft.graph.conditionalAccessGrantControls",
    "operator": "OR",
    "builtInControls@odata.type": "#Collection(microsoft.graph.conditionalAccessGrantControl)",
    "builtInControls": [
      "block"
    ],
    "customAuthenticationFactors@odata.type": "#Collection(String)",
    "customAuthenticationFactors": [],
    "termsOfUse@odata.type": "#Collection(String)",
    "termsOfUse": [],
    "authenticationStrength@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies('ff0b4179-d1e7-41b4-aaeb-7c8ef89048d2')/grantControls/authenticationStrength/$entity",
    "authenticationStrength@odata.associationLink": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('ff0b4179-d1e7-41b4-aaeb-7c8ef89048d2')/grantControls/authenticationStrength/$ref",
    "authenticationStrength@odata.navigationLink": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('ff0b4179-d1e7-41b4-aaeb-7c8ef89048d2')/grantControls/authenticationStrength",
    "authenticationStrength": null
  },
  "#microsoft.graph.restore": {
    "title": "microsoft.graph.restore",
    "target": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('ff0b4179-d1e7-41b4-aaeb-7c8ef89048d2')/microsoft.graph.restore"
  },
  "Tag": "jv-CAF-2026.2.1",
  "summary": "The CA301-ServiceAccounts-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUntrustedLocations policy blocks your service accounts group from signing in from any location, with the intention that you exclude your trusted named locations after import. Service accounts tend to have predictable homes, a couple of servers or offices, so anything outside those is almost certainly trouble. Populate the location exclusions with your known networks before enabling it, then anything appearing from an unexpected IP address gets stopped at the door."
}