How can organizations scale US-only Conditional Access with country-specific travel exceptions?

For US-only access with country-specific travel, I would manage travel cohorts rather than edit individual users into policies for every trip. Keep the baseline block policy for all locations except the US. For a France-travel cohort, exclude that group from the baseline, then apply a separate block policy to that group for all locations except the US and France. Keep cohorts nonoverlapping: a user in two country-specific block policies can still be blocked because all applicable policies are evaluated. Retain MFA and device requirements independently. Use time-bound active group membership through PIM for Groups, where licensed, so a trip has an expiry and returns to the baseline afterward. Test each cohort with What If, report-only mode and sign-in logs before enforcement, including expiry behavior. Exclude emergency-access accounts appropriately. Country detection is based on IP or configured GPS signals, so verify actual travel sign-in locations rather than assuming geographic precision.