How can I design conditional access policies for geofencing that allow single user country exceptions?

Question

In AzureAD, I have a global conditional access policy (cap) that prevents users from accessing their accounts from non approved countries (I do realize this is not an accurate/reliable means of securing an environment). We do have MFA configured for these as well.

When people travel we put them in an exception group so they can go to Bali or wherever.

There is a finite list of people that remote work from locations we generally ban e.g. India, Ghana etc. For those folks, they are permanently in the exception list. That list is meant to be temporary.

I could make more CAPs for these individual users but that could get out of hand if I made a block-all-but-india for example and those users would be in the exclude of the main policy. Would be messy real quick.

I want to be able to say that an individual can go to this one country but the rest of them are banned just like everyone else. Best I can tell CAP is not meant for than granularity.

Is there a CAP methodology I could use to implement what I am describing?

Answer 1

You could create an automation runbook with a PowerShell script which adds a user to a group and automatically deletes them from the group after the month. The PowerShell script would create a file in a storage account with user x excluded date and then other script in the same runbook queries that file and deletes the file when they are in that group for example for a month. This does require some custom scripting work And then exclude that group from the non approved locations in Conditonal Access.

Here is an example of those two scripts

# Script 1: addUserToGroup.ps1

# Define variables
$storageAccountName = "<storage_account_name>"
$containerName = "<container_name>"
$fileName = "exclusion_dates.txt"
$groupName = "<group_name>"
$username = "<username>"

# Add user to the group
Add-ADGroupMember -Identity $groupName -Members $username

# Get the current date and calculate the exclusion date (1 month later)
$currentDate = Get-Date
$exclusionDate = $currentDate.AddMonths(1)

# Format the exclusion date
$formattedDate = Get-Date $exclusionDate -Format "yyyy-MM-dd"

# Create or update the file in the storage account with the exclusion date
$filePath = "$containerName/$fileName"
"$username $formattedDate" | Set-Content -Path $filePath -Force

Write-Host "User $username added to group $groupName. Exclusion date recorded."

---

# Script 2: checkExclusionAndRemoveUser.ps1

# Define variables
$storageAccountName = "<storage_account_name>"
$containerName = "<container_name>"
$fileName = "exclusion_dates.txt"
$groupName = "<group_name>"
$username = "<username>"

# Get the current date
$currentDate = Get-Date

# Query the file for user exclusion date
$filePath = "$containerName/$fileName"
$exclusionInfo = Get-Content -Path $filePath

# Check if the user should be removed from the group
if ($exclusionInfo -ne $null -and $exclusionInfo -match "$username (\d{4}-\d{2}-\d{2})") {
    $storedDate = $matches[1]
    $storedDateObject = Get-Date $storedDate
    if ($currentDate -ge $storedDateObject) {
        # Remove user from the group
        Remove-ADGroupMember -Identity $groupName -Members $username -Confirm:$false

        # Log the removal event (you can customize this part)
        $logFilePath = "group_removal_log.txt"
        "$currentDate: Removed $username from $groupName" | Out-File -Append -FilePath $logFilePath

        Write-Host "User $username removed from group $groupName."
    }
    else {
        Write-Host "User $username is still within the exclusion period."
    }
}
else {
    Write-Host "No exclusion information found for user $username."
}