Block

CA505-Agents-AttackSurfaceReduction-AllAgentUsers-AllResources-RequireCompliantNetWork

Block access

About this policy

The CA505-Agents-AttackSurfaceReduction-AllAgentUsers-AllResources-RequireCompliantNetWork policy blocks agent users from every location except your compliant network, referenced as an excluded named location. In practice, agents can only operate when their traffic arrives through Global Secure Access, so anything reaching your resources from an arbitrary network is refused. It is a strong way to pin agents to infrastructure you control. Just confirm the compliant network location exists in your tenant before switching it on, or agents will be blocked everywhere.

Policy conditions

Users: All agent users
Apps: All cloud apps

JSON template

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies/$entity",
  "templateId": null,
  "displayName": "CA505-Agents-AttackSurfaceReduction-AllAgentUsers-AllResources-RequireCompliantNetWork",
  "modifiedDateTime": null,
  "state": "enabledForReportingButNotEnforced",
  "deletedDateTime": null,
  "partialEnablementStrategy": null,
  "sessionControls": null,
  "conditions": {
    "userRiskLevels": [],
    "signInRiskLevels": [],
    "clientAppTypes": [
      "all"
    ],
    "platforms": null,
    "times": null,
    "deviceStates": null,
    "devices": null,
    "clientApplications": null,
    "applications": {
      "includeApplications": [
        "All"
      ],
      "excludeApplications": [],
      "includeUserActions": [],
      "includeAuthenticationContextClassReferences": [],
      "applicationFilter": null
    },
    "users": {
      "includeUsers": [
        "None"
      ],
      "excludeUsers": [],
      "includeGroups": [],
      "excludeGroups": [],
      "includeRoles": [],
      "excludeRoles": [],
      "includeGuestsOrExternalUsers": null,
      "excludeGuestsOrExternalUsers": null
    },
    "locations": {
      "includeLocations": [
        "All"
      ],
      "excludeLocations": [
        "3d46dbda-8382-466a-856d-eb00cbc6b910"
      ]
    },
    "agents": {
      "includeAgentUsers": [
        "All"
      ],
      "excludeAgentUsers": [],
      "agentFilter": null
    }
  },
  "grantControls": {
    "operator": "OR",
    "builtInControls": [
      "block"
    ],
    "customAuthenticationFactors": [],
    "termsOfUse": [],
    "authenticationStrength@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies('de7dcc32-cf6a-4651-8e45-8f38332155e2')/grantControls/authenticationStrength/$entity",
    "authenticationStrength": null
  },
  "summary": "The CA505-Agents-AttackSurfaceReduction-AllAgentUsers-AllResources-RequireCompliantNetWork policy blocks agent users from every location except your compliant network, referenced as an excluded named location. In practice, agents can only operate when their traffic arrives through Global Secure Access, so anything reaching your resources from an arbitrary network is refused. It is a strong way to pin agents to infrastructure you control. Just confirm the compliant network location exists in your tenant before switching it on, or agents will be blocked everywhere."
}