Conditional Access Country Login Block

Question

This could all just be because I don't understand some parts of this policy. I went through https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-policy-location and setup a conditional access policy for blocking emails from certain countries like India and China since they are either for real or through proxy/vpn pounding one of our mailboxes trying to login. I enabled it, but the sign-in logs still show that there are login attempts from those locations as well as others that were tagged to be blocked. The policy has been running for about a week now so it should have made it through the system. The basic info for one of them shows this which is what has always been shown.

Location shows this. The location name is the name of my conditional access policy.

It looks like they are not even getting blocked since the rejection was due to incorrect password not the policy.

Answer 1

Hi Jon,

Even though you have set the policy it still requires the people to try and authenticate to the accounts. (This is also how Multi-Factor and Modern Authentication works). The Conditional Access Policy only kicks in after the first layer of authentication is completed.

Unfortuantely, your logs will still continue to fill up and this is completely normal (indicating that the people have tried to authenticate against the account and failed due to being blocked).

Learn about Conditional Access and Intune

https://learn.microsoft.com/en-us/mem/intune/protect/conditional-access

If this is helpful please accept answer.