A great way to mitigate suspicious logins is to directly deny / allow only the locations or IP address's you would like to have access to your cloud environment. Approving specific locations or IP's will inherently unapproved all other locations / IP's, where as Unapproving will directly disable logins form those sources.
Microsoft 365 License Requirement: P1/P2 or higher(e.g. A3)
NOTE: To enforce policy on Unapproved logins see the Policy Guide.
STEP ONE:
Sign into your Cloud Access Monitor Instance.
STEP TWO:
Select the "Edit" pencil on your desired environment.
Microsoft 365 License Requirement: P1/P2 or higher(e.g. A3)
NOTE: User policies are only effective if your license level contains login monitoring access.
STEP THREE:
Scroll to the bottom of the page, under the "Advanced Settings" you will find the rules for location and IP.
STEP FOUR:
NOTE: Approved and unapproved country lists are exclusive. This means whichever you have selected will be the activated rule. All countries not explicitly mentioned will have the rule applied to them.
Ex: Approved Countries is selected and United States is filled in. All countries OTHER than the USA will be considered unapproved.
Ex: Unapproved Countries is select and United States is filled in. Only the united states will be considered unapproved.
Approving a Location:
To approve location simply select "Approved Countries" tab at the top of the card, and then type in the location(s) you wish to allow access.
Unapproving a Location:
To unapprove a location, change the tab to "Unapproved Countries" and in the box below select the location(s) you would like to revoke access to.
Approve IPs: To approve an IP address look to the right of the countries rule, and select "Approved IPs" from the dropdown, enter in the IP(s) that you would like to allow.
Unapprove IPs:
To unapprove an IP select "Unapproved IPs" from the dropdown, and enter the IP address(s) that you would like to restrict access from.
STEP FIVE:
Select the "Save" button on the bottom right. access rules are now complete.
