Conditional Entry insurance policies are inclined to multiply. You begin with a handful of baseline insurance policies, and some years later you have got 20 or 30 of them, most with the identical break-glass accounts within the exclusion listing. So each change to these exclusions means enhancing every coverage one after the other.
Microsoft is now testing coverage plans in Entra ID. A plan teams associated insurance policies underneath shared situations, so issues like your exclusions are outlined as soon as and inherited by each rule within the plan. It’s nonetheless in preview, but it surely’s already displaying up in manufacturing tenants.
On this article, we’ll take a primary have a look at what coverage plans are, discover insurance policies which you could merge, and migrate, validate and again up your plans.
What Are Conditional Entry Coverage Plans
Coverage plans are a brand new object in Conditional Entry. A plan teams guidelines round one safety goal, for instance blocking dangerous sign-ins or requiring MFA outdoors the workplace. It has three elements:
| Half | What it holds |
|---|---|
| Plan particulars | Title, description, tags and house owners. The proprietor subject is for accountability solely and doesn’t grant permissions to coverage plans. |
| Shared situations | Customers, sources and situations that apply to each rule within the plan (elective). |
| Guidelines | Every rule has its personal customers, sources, situations and grant or session controls. A plan wants a minimum of one rule. |
A rule is mainly a standard Conditional Entry coverage that additionally inherits the shared situations of its plan. At sign-in, every rule is evaluated independently and reveals up as a separate entry within the sign-in logs.
Plans don’t exchange your current insurance policies. Each are evaluated subsequent to one another, and each coverage and each rule that applies have to be happy earlier than entry is granted. To create or edit a plan you want the Conditional Entry Administrator position.
How Shared Situations and Guidelines Work
Shared situations and rule situations add up. Each rule inherits the plan’s concentrating on and exclusions, and a rule can add its personal exclusions on prime. However a rule can’t slim the plan’s concentrating on or take away an exclusion that’s set at plan stage. Within the rule editor, these inherited settings are locked.
Not every part will be shared although:
- You possibly can solely choose All customers and All sources in a rule, not at plan stage.
- Grant and session controls solely exist within the guidelines.
- A plan can’t goal each customers and workload identities at plan stage. If you would like each in a single plan, go away the identities to the principles.
Most baseline insurance policies goal All customers and All sources, so for these insurance policies the exclusion listing is actually the one factor you possibly can share.
The plan editor does supply extra situations than the documentation mentions. In addition to danger ranges, system platforms, areas and shopper app varieties, it’s also possible to share agent danger, insider danger, a tool filter and authentication flows. And at plan stage, you possibly can exclude full listing roles as effectively.
Discover Insurance policies to Merge with PowerShell
Microsoft recommends grouping insurance policies by protected useful resource, by persona (the identical customers with completely different controls) or by a shared situation, like a location or danger stage. The portal doesn’t enable you to with that. The migration wizard simply reveals an inventory of your insurance policies, and it’s as much as you to determine which of them belong collectively.
So I created a PowerShell script that teams your insurance policies and predicts, based mostly on my checks with the preview, what the migration instrument will transfer to the shared situations. It additionally tells you what it is advisable to do your self after the merge.
The script solely reads your configuration with the Coverage.Learn.All and Listing.Learn.All scopes. You possibly can obtain it from my GitHub repository.
.Discover-CAPolicyPlanCandidates.ps1.Discover-CAPolicyPlanCandidates.ps1 -NamePattern 'CA*' -IncludeDisabledThe outcomes are proven within the console and saved as a Markdown report. This is among the candidates from my dev tenant:
CA006 and CA007 are a great match, each block dangerous sign-ins. CA003 is in there as a result of it targets the identical customers with the identical exclusions, however blocking international locations is a special goal. So use the output as a place to begin, you continue to resolve which insurance policies belong in the identical plan.
Now, you would possibly count on the migration to maneuver the 2 exclusions within the instance above to the plan, they’re the identical in all three insurance policies. However the migration solely strikes customers to the plan when the entire person project is similar, and All customers can’t be set at plan stage.
These insurance policies goal All customers, so the entire project, together with the exclusions, stays in every rule. That’s why the script tells you so as to add the exclusions to the plan your self.
Migrate Insurance policies to a Coverage Plan
The migration instrument strikes the settings that the chosen insurance policies have in widespread to the shared situations, and turns every coverage right into a rule. Your authentic insurance policies will not be modified, and the brand new guidelines are created within the Off state.
- Open the Microsoft Entra Admin Heart
- Broaden Entra ID and open Conditional Entry > Insurance policies
- Within the Migrate to Conditional Entry Coverage plans (Preview) banner, click on Get began
- Choose the insurance policies and click on Merge insurance policies right into a plan
- Enter a Coverage plan identify. In the event you go away it empty, each plan is named Migrated coverage plan
- Overview the shared situations and guidelines, and click on Create coverage plan
I used the identical numbering as for my insurance policies, so for instance PLN01 – World: Block dangerous sign-ins and customers. Every rule retains the identify of the unique coverage.
What the Migration Really Shares
Based on the documentation, the settings the chosen insurance policies have in widespread develop into shared situations. In my checks, that solely labored for the situations:
| Insurance policies | Customers in each insurance policies | Shared by the migration |
|---|---|---|
| CA006 + CA007 (block excessive danger) | All customers, identical two exclusions | Consumer apps |
| CA001 + CA100 (require MFA) | All customers and admin roles, identical three exclusions | Consumer apps, location |
| CA901 + CA902 (HR registration) | HR group, identical two exclusions | Customers, shopper apps |
Situations are moved when they’re similar in each chosen coverage, like the placement within the MFA set. Customers are solely moved when the entire project is similar and the embody isn’t All customers.
So even when the exclusions are precisely the identical, they keep in every rule. The shared shopper apps situation is simply the default worth All, which each coverage has.
Transfer the Exclusions to the Plan
For many baseline insurance policies, this implies you need to transfer your break-glass exclusions your self:
- Go to Entra ID > Conditional Entry > Coverage plans (Preview) and open the plan
- Click on Edit plan
- Underneath Shared identities, click on Add customers, brokers, or workload identities > Excluded customers, and add your emergency entry accounts
- Save the plan
The rule will take over the inherited exclusions from the plan, so that you don’t must take away them manually from the rule after you have got added the exclusion on plan stage.
Validate the Plan and Swap Over
All guidelines begin within the Off state, and enhancing the plan doesn’t change that. So set the principles to Report-only, per rule or all of sudden with Edit all guidelines. Your authentic insurance policies preserve doing their job within the meantime.
To examine the outcomes, go to Entra ID > Monitoring & well being > Signal-in logs, open a sign-in of a person in scope of the plan, and evaluate the results of every rule on the Report-only tab with the unique coverage.
You may as well examine within the Coverage Plan when guidelines the place triggered, and resulted in a profitable or failed sign-in,.
Understand that the migration copies your insurance policies. After the merge, the principles and the unique insurance policies are separate objects. So don’t make modifications to the unique insurance policies when you validate, or you find yourself with two variations that drift aside.
When the outcomes match, change over:
- Set every rule within the plan to On
- Set the unique insurance policies to Off
- Examine the sign-in logs once more to substantiate nothing modified
- Delete the unique insurance policies after your validation interval
Flip the principles on earlier than you flip the insurance policies off. For a second the identical management is enforced twice, which is innocent. The opposite method round leaves a niche the place nothing is enforced.
Again Up your Coverage Plans
Coverage plans will not be included in your present Conditional Entry backups. The principles don’t present up in Get-MgIdentityConditionalAccessPolicy, additionally not within the beta model of the cmdlet. Plans have their very own Graph endpoint, which isn’t documented but.
However we will learn them by calling the beta/id/conditionalAccess/plans endpoint with the Coverage.Learn.All permission, and the response contains the principles of every plan:
Join-MgGraph -Scopes 'Coverage.Learn.All'$plans = Invoke-MgGraphRequest -Technique GET -Uri 'https://graph.microsoft.com/beta/id/conditionalAccess/plans'$plans.worth | ForEach-Object { "$($_.displayName) - $($_.guidelines.Depend) guidelines" }
Two issues matter once you again up or restore plans. The grant and session controls of a rule are saved underneath controls, as a substitute of on the prime stage like in a coverage. And a rule solely comprises its personal settings, not the inherited shared situations. In my HR plan, the principles haven’t any customers configured in any respect, they arrive from the plan. So all the time again up the plan and its guidelines collectively.
I created an export Coverage Plan script that can backup the plans and guidelines. It saves each plan with its guidelines to a JSON file, and writes a Markdown abstract of the shared situations and guidelines:
.Export-CAPolicyPlans.ps1 -ExportFolder C:BackupCA-PolicyPlansObserve
The plans endpoint is in beta, so property names should change. Examine your backup scripts once more when coverage plans develop into usually obtainable.
Preview Limitations
In addition to the migration and backup gaps, there’s yet another factor to remember. In the course of the preview, guidelines that focus on customers with a location situation get one-hour entry tokens, with out the moment IP examine of Steady Entry Analysis.
So if a person leaves an allowed location, it could actually take as much as an hour earlier than the rule applies. The candidates script flags these insurance policies in its report.
Wrapping Up
Coverage plans appear like a good way to construction and group your Conditional Entry insurance policies. Managing your break-glass, or trusted areas exclusions in a single place as a substitute of in 20 insurance policies is very nice.
However this can be a first model. The migration doesn’t transfer your exclusions, each rule must be validated, and your backup and documentation instruments can’t see plans but. So for now, migrate a couple of insurance policies, preserve the principles in Report-only mode, and use the time till basic availability to determine which insurance policies belong collectively.
I hope you favored this text, if in case you have any questions, simply drop a remark beneath.
