{
  "id": "CB-M365-AUTH-033",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-033",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-033.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-033.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-033",
    "title": "Block sign-ins from outside the approved countries",
    "finding": {
      "title": "Users can sign in from any country",
      "description": "Stolen credentials can be used from any country, including those where the organization has no staff or business."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "conditional-access",
      "named-locations",
      "geo-blocking",
      "countries"
    ],
    "applicability": {
      "requires": [
        "Microsoft Entra ID P1"
      ]
    },
    "description": "A **Countries location** named location lists the countries where the organization operates\n({{ allowed_countries }}). A Conditional Access policy targets all users on all resources,\nincludes **Any location**, excludes that named location (and the trusted IP locations), and\napplies **Block access**. Unknown countries are not part of the allowed list, so they are blocked.\n\nUsers who travel to other countries are handled by a time-limited exception group, managed by the\nhelp desk.\n",
    "rationale": "Most password spray and credential stuffing traffic comes from hosting providers and countries\noutside the organization's footprint. Geo-blocking removes a large share of that noise and of the\nreal attempts, and makes the remaining ones more visible.\n",
    "impact": "Travelers and staff abroad are blocked unless added to the exception group. Location is derived\nfrom the public IP address: consumer VPNs, mobile roaming and cloud proxies can make a user appear\nin another country. Exclude service accounts that run from cloud regions outside the list.\nAttackers can use proxies inside allowed countries, so this does not replace MFA or risk\npolicies.\n",
    "notes": "Determine the location by IP address; GPS-based locations need Microsoft Authenticator and do not\nwork with passwordless methods. Guests from foreign partner tenants are also blocked: scope the\npolicy to members, or add their countries, if collaboration requires it.\n",
    "parameters": [
      {
        "name": "allowed_countries",
        "type": "list",
        "description": "ISO 3166-1 alpha-2 codes of the countries from which sign-ins are allowed. Default is the European Union.",
        "default": [
          "AT",
          "BE",
          "BG",
          "CY",
          "CZ",
          "DE",
          "DK",
          "EE",
          "ES",
          "FI",
          "FR",
          "GR",
          "HR",
          "HU",
          "IE",
          "IT",
          "LT",
          "LU",
          "LV",
          "MT",
          "NL",
          "PL",
          "PT",
          "RO",
          "SE",
          "SI",
          "SK"
        ]
      }
    ],
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Security Reader.\n2. Browse to **Entra ID** > **Conditional Access** > **Named locations** and open the countries\n   location; check that it contains {{ allowed_countries }} and that **Include unknown\n   countries/regions** is not selected.\n3. Browse to **Conditional Access** > **Policies** and find a policy with **State** **On**:\n   **Users** > **All users** (exclusions limited to emergency access accounts and the travel\n   exception group); **Target resources** > **All resources**; **Conditions** > **Network** >\n   **Include** **Any network or location**, **Exclude** the allowed countries location;\n   **Grant** > **Block access**.\n4. Review the members of the travel exception group: each entry must have an end date.\n5. Alternative in PowerShell (Microsoft Graph, scope `Policy.Read.All`):\n   `Get-MgIdentityConditionalAccessNamedLocation | Where-Object { $_.AdditionalProperties.countriesAndRegions } | Select-Object DisplayName, @{n='Countries';e={$_.AdditionalProperties.countriesAndRegions}}`\n6. Fail if no such enabled block policy exists, or if the exception group holds permanent\n   members without justification.\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.\n2. Browse to **Entra ID** > **Conditional Access** > **Named locations** > **Countries\n   location**, name it (for example `Allowed countries`), select **Determine location by IP\n   address**, tick {{ allowed_countries }} and **Create**.\n3. Create a group for travel exceptions, with a process that removes members at the end of the\n   trip (an access package with an expiry date works well).\n4. **Policies** > **New policy**: **Users** > **All users**, exclude the emergency access\n   accounts and the exception group; **Target resources** > **All resources**; **Network** >\n   **Include** **Any network or location**, **Exclude** **Selected networks and locations** > the\n   allowed countries and the trusted IP locations; **Grant** > **Block access**.\n5. Start in **Report-only**; review blocked sign-ins for legitimate users for two weeks, then\n   switch to **On**.\n",
      "rollback": "Set the policy to **Report-only** or **Off**, or add the affected users to the exception group.\n"
    },
    "references": [
      {
        "title": "Block access by location",
        "url": "https://learn.microsoft.com/entra/identity/conditional-access/policy-block-by-location",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Network-based Conditional Access - countries",
        "url": "https://learn.microsoft.com/entra/identity/conditional-access/concept-assignment-network",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-3",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-17",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      },
      {
        "framework": "mitre-attack",
        "id": "T1110.003"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-032",
        "type": "related"
      },
      {
        "id": "CB-M365-ADMIN-002",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}