Block

CA504-Agents-IdentityProtection-AllAgentUsers-AllResources-BlockRiskyAgents

Block access

About this policy

The CA504-Agents-IdentityProtection-AllAgentUsers-AllResources-BlockRiskyAgents policy blocks all agent users from every resource when their identity risk is high. It works hand in hand with the other agent policies, providing the risk based cut off for your agent workforce. If the risk engine decides an agent identity looks compromised, access simply stops until someone reviews it. Given agents can hold broad permissions and operate around the clock, an automatic brake like this is well worth having in place.

Policy conditions

Users: All agent users
Apps: All cloud apps
Risk: Agent identity risk: high

JSON template

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies/$entity",
  "templateId": null,
  "displayName": "CA504-Agents-IdentityProtection-AllAgentUsers-AllResources-BlockRiskyAgents",
  "modifiedDateTime": null,
  "state": "enabledForReportingButNotEnforced",
  "deletedDateTime": null,
  "partialEnablementStrategy": null,
  "sessionControls": null,
  "conditions": {
    "userRiskLevels": [],
    "signInRiskLevels": [],
    "clientAppTypes": [
      "all"
    ],
    "agentIdRiskLevels": "high",
    "platforms": null,
    "locations": null,
    "times": null,
    "deviceStates": null,
    "devices": null,
    "clientApplications": null,
    "applications": {
      "includeApplications": [
        "All"
      ],
      "excludeApplications": [],
      "includeUserActions": [],
      "includeAuthenticationContextClassReferences": [],
      "applicationFilter": null
    },
    "users": {
      "includeUsers": [
        "None"
      ],
      "excludeUsers": [],
      "includeGroups": [],
      "excludeGroups": [],
      "includeRoles": [],
      "excludeRoles": [],
      "includeGuestsOrExternalUsers": null,
      "excludeGuestsOrExternalUsers": null
    },
    "agents": {
      "includeAgentUsers": [
        "All"
      ],
      "excludeAgentUsers": [],
      "agentFilter": null
    }
  },
  "grantControls": {
    "operator": "OR",
    "builtInControls": [
      "block"
    ],
    "customAuthenticationFactors": [],
    "termsOfUse": [],
    "authenticationStrength@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies('12993033-689f-4c13-b6af-a9af13790044')/grantControls/authenticationStrength/$entity",
    "authenticationStrength": null
  },
  "summary": "The CA504-Agents-IdentityProtection-AllAgentUsers-AllResources-BlockRiskyAgents policy blocks all agent users from every resource when their identity risk is high. It works hand in hand with the other agent policies, providing the risk based cut off for your agent workforce. If the risk engine decides an agent identity looks compromised, access simply stops until someone reviews it. Given agents can hold broad permissions and operate around the clock, an automatic brake like this is well worth having in place."
}