CA-08MediumRecommended Secure

Block Access from High-Risk Countries

Conditional Access control for Microsoft 365 and Entra ID

Why This Control Matters

Blocking access from high-risk countries reduces geopolitical risk and helps comply with export control regulations (ITAR, EAR). While VPNs can bypass this control, it stops opportunistic attacks and reduces your attack surface from nation-state threat actors.

Expected State

When this control is compliant, your tenant should meet these criteria:

  • 1Conditional Access policy blocks access from high-risk countries
  • 2Country-based named location configured with sanctioned/high-risk nations
  • 3Level 1: North Korea, Iran, Syria
  • 4Level 2: + Russia, Cuba
  • 5Level 3: + China, Belarus, Venezuela

Enforcement

Default Mode
Advisory

Alerts on deviations but does not make changes

Auto-Remediation
Available

Creates country-based named location and blocking CA policy. Emergency accounts are excluded.

Ready to implement this control?

TrueConfig continuously monitors your Microsoft 365 tenant for compliance with this and 50+ other security controls.