Monitoring and securing logins outside your Country with Conditional Policy & Automate Blocking personal Devices in Azure AD with Sentinel

A common way to protect your azure & Office 365 tenant, reducing the exposure, is a conditional policy allowing only to perform logins on the source country of origin. Since there are as many countries as you can guess, the attackers or adversaries will also have to guess such country.

The idea of this monitoring & Automation is to reduce attack surface in case someone could have guessed the password or stolen the auth cookie on one of your users, hence using it from a malicious machine. But adversaries may not know or not be aware of this conditional policy, hence this could be handy to protect the users.

In this case, we are not going to block corporate devices, we understand the majority of this surface attacks or miss use of the users (VPN, travel) comes from personal devices.

Our defences will be the following :

  • Combine this automation with MFA Conditional policy
  • Combine this automation with Block Legacy AUTH conditional Policy

You can apply these policies from the Templates blade.

  • Conditional Policy, only allowing Country where the company works or has branches to access

Click here for MS article on how to do this

  • Automate successful logins from countries not expected and block personal devices (
  • In this case, our country will be GB (Great Britain). As per the Analytics rule on Sentinel.

Automation of successful logins block from unexpected countries


  • Step 1 : Create the Sentinel Analytic rule When creating the rule make sure you map entities (account , Full name , User ID )
  • Configure the rule to run looking the desired time ( 4h , 1h ) etc. on the logins logs

SigninLogs
| where Location !contains "GB"
| summarize NoGBlogins = count ()
    by
    TimeGenerated,
    UserId,
    UserDisplayName,
    UserPrincipalName,
    Location,
    ResultDescription
| where ResultDescription contains "Access has been blocked due"
| order by UserPrincipalName, NoGBlogins, ResultDescription
| where isnotempty(Location)
| where isnotempty(ResultDescription)
  • Step 2 : Create an Azure Security group (To which we will apply a conditional policy that will block Personal Devices) + Conditional Policy—Block Personal Devices. Screenshots have been attached.

In This case, this conditional policy looks for : Azure AD devices, but you can lock it down to Hybrid. This will be based on your environment. You’re looking to apply this security group that sentinel will be filling up to such conditional policy.

Note that : Apple devices may be affected (even if they are corporate). Because they are considered not Azure AD joined.


Step 3 : Automation Rule in Sentinel—Logic App on trigger

  • Create an automation rule in sentinel to “fill in this security group” of the matches found
  • Modify your logic app at your convenience

In this case, the automation rule will run when “Such logins are detected” or it can happen once per day

The idea of the logic app would be the following:

We can see once configured in action the play book adding / removing users in the logic app run history & Group audit logs.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.