Forum Discussion

Dan Moran's avatar
Dan Moran
Copper Contributor
Nov 18, 2022

Blocking International Countries

We have a conditional access policy that logs off accounts after 5 failed attempts. We also have an international policy blocking all international countries and IPs. unfortunately, these attempts ...
Thiago-Beier's avatar
Thiago-Beier
MCT
Dec 20, 2022
hi again Dan Moran, I did remember leveraging MCAS (CASB) to block from "blocked countries" all access to https://portal.office.com , once and the client liked because that reduced the accounts lockouts , I'll check if I still have it documented to share.
Dan Moran's avatar
Dan Moran
Copper Contributor
Dec 20, 2022

Thiago-Beier 

any help would be greatly appreciated.  I will try to find the setting on my side as well.

  • Thiago-Beier's avatar
    Thiago-Beier
    MCT
    Dec 21, 2022

    Hi again , my access was revoked I got a screenshot here
    I need to revisit this topic but this helped us to get accounts blocked before MFA

    I'll see if I can get this going on my DEMO tenant to post it 

    Dan Moran 

    • Dan Moran's avatar
      Dan Moran
      Copper Contributor
      Dec 22, 2022

      Thiago-Beier 

      This is very similar to policies we already have in place.  But I did create a new one based on your settings and I just got kicked again by a location that was specifically named in this new policy.  It also says this policy was not matched.

      We have an AD policy that locks accounts after 5 bad attempts.  It seems these attempts are triggering that policy before it can get to a policy like this.

      The hope was to have policies like these in front of our 5 attempt lockout but that seem to be where the drop is.

       

      Dan

Resources