📋 GRC compliance for CMMC 2.0, CPCSC, CPA Canada, IIROC…SaaS discovery for data governanceFree enriched web chat widget🚀 Enriched remote support without your laptop

Geo Conditional Access

Block Microsoft 365 sign-ins from countries a client does not work in, open a country for one traveller for their trip only, and keep break-glass accounts out of every block.

Open Microsoft 365 in your console

Where to find it
Microsoft 365 › Investigate & manage › Geo Conditional Access Manager
Who can use it
Anyone who can see the page can view it. Super Admin, Admin, MSP Client Admin and Client Local IT can change the allowed countries and travel for individual people. Only Super Admin, Admin and MSP Client Admin can change the mode, the blocking switches, break-glass accounts and travel for everyone.
For
MSPs and organizations
Plan
M365 / Google Workspace Monitoring (included in Grow, Professional, and Complete). See pricing
Microsoft requirements
Microsoft Entra ID P1 or higher (included in Microsoft 365 Business Premium), security defaults off, and read and write access granted to Lavawall
Feature
Country-based sign-in blocking

What the page is for

The Geo Conditional Access Manager is a section of the Microsoft 365 page in the Lavawall® console. Lavawall is the RMM, security, and compliance platform from ThreeShield, built and hosted in Canada.

Most businesses sign in from a few countries. This section proposes those countries from the client’s successful sign-ins over the last 90 days, then sets up and keeps a Microsoft Entra Conditional Access policy that blocks sign-ins from everywhere else. Failed sign-ins are left out, so an attacker’s attempts never make their country look normal.

When someone travels, you add their trip. The trip countries open for that person only, from their first day to their last, through a policy of their own. Break-glass accounts you choose are never blocked by any of these policies.

Lavawall keeps the policies the way you set them here. If someone changes or deletes them in the Microsoft Entra admin centre, Lavawall puts them back the next time it applies your settings.

What you see

The Geo Conditional Access Manager, with enforcement, apply status, break-glass accounts, allowed countries, travel exceptions, objects in the tenant and the audit log numbered 1 to 7.
The Geo Conditional Access Manager. Numbers match the list below.
  1. Enforcement: the Mode (Off, Report only or Enforce) and the Block unknown countries and Block Tor exit nodes switches.
  2. The apply status (Applied, Applying to the tenant, Partly applied or Not applied, with the reason), when settings were last applied, and Apply now.
  3. Break-glass accounts: emergency accounts that are never blocked, with Add account and a remove button for each.
  4. Allowed countries (baseline): the countries sign-ins are allowed from, with Add country and Analyze sign-ins.
  5. Travel exceptions: active and scheduled trips with their countries, dates, status and whether the traveller’s own policy is ready, a filter, sortable columns and Schedule travel.
  6. In the tenant: the allowed-countries location and the block policies Lavawall keeps in Microsoft 365.
  7. Audit log: every change, who made it and when.

How to set up country blocking

  1. Open the client’s Microsoft 365 page, expand Investigate & manage and find Geo Conditional Access Manager.
  2. If a Write access required box is shown, click Re-authorize read and write and grant consent as a Microsoft 365 administrator, then click Test permissions.
  3. Under Allowed countries (baseline), click Analyze sign-ins. Review the proposed countries. People who signed in from other countries are listed underneath: tick anyone who really works from there to give them a standing travel exception, and look into anything you do not recognize. Click Save as baseline.
  4. Under Break-glass accounts, click Add account, choose an emergency account and click Add. Add a second one if you have it.
  5. Under Enforcement, choose Report only. Within about a minute the status changes to Applied.
  6. Check the report-only results in the Microsoft Entra sign-in logs. When you are happy with them, choose Enforce and confirm.

How to add a trip

  1. Under Travel exceptions, click Schedule travel.
  2. Choose the travellers in Travellers and the countries in Countries.
  3. Set the First day and Last day. Days are in your own time zone.
  4. Add a Reason if you like, then click Schedule.
  5. When the trip starts, its Policy column changes to Ready. The countries close again after the last day.

How to end a trip early

  1. Find the trip under Travel exceptions.
  2. Click its end button and confirm with End now.

How to turn blocking off

  1. Under Enforcement, choose Off and confirm.
  2. Lavawall turns the block policies off in the tenant and removes the travellers’ policies. Your baseline, travel and break-glass settings are kept.

Tips

  • Use dedicated cloud-only emergency accounts as break-glass accounts, protect them with phishing-resistant sign-in, keep their credentials offline, and alert on every sign-in.
  • Enforce is not available until at least one break-glass account is set, and Lavawall keeps the policy in report-only until one exists in the tenant and is enabled.
  • Prefer a trip for the people travelling over Everyone in the tenant. Opening a country for everyone also opens it to anyone using a stolen password.
  • Up to 40 people can have a trip at the same time, because each one uses a Conditional Access policy of their own.
  • Anonymous proxies and VPNs cannot be blocked reliably by list. Tenants with Microsoft Entra ID P2 can block them with a sign-in risk policy.
  • Make changes here, not in the Microsoft Entra admin centre. Changes made there to these policies are put back.

Troubleshooting

“Write access required.”
Lavawall has not been allowed to change Conditional Access in this tenant. Click Re-authorize read and write and grant consent as a Microsoft 365 administrator.
“Policy.Read.All is missing.”
Microsoft needs this permission as well, before policies can be created. Click Re-authorize read and write.
“Security defaults are on in this tenant.”
Conditional Access cannot be used while security defaults are on. Turn them off in the Microsoft Entra admin centre once the policies you need are in place.
“This tenant needs Microsoft Entra ID P1 or higher.”
Conditional Access is part of Entra ID P1, which is included in Microsoft 365 Business Premium.
A trip’s Policy shows Error.
The traveller’s own policy could not be created, so they stay blocked outside the allowed countries. The reason is shown under the badge. Fix it, then click Apply now.
“Your role cannot change Conditional Access settings.”
Ask a Super Admin, Admin or MSP Client Admin to make the change.

Still need help?

Search the support centre, or contact our support team and tell us which page you were on:

Names, companies, devices and figures in the pictures are examples. Other product and company names are trademarks of their respective owners.

We use privacy-friendly, cookieless analytics to count visits, and one cookie to run our live chat. Both load only if you accept. We do not use advertising trackers, and we do not profile you across other websites. The essential cookies that keep the site working are always on. See our privacy policy.