Geo Restriction & Conditional Access

[gibbzie]

Wondering if anyone has experience on this or a good method to implement.

We have various conditional access policies setup and one of them is to only allow logins from a particular country, all the other countries are blocked. In that policy there is an exclusion linked to a security group.

Often users need to travel and would be placed into the security group for the duration of their travels, this will allow them to still access their apps and sign into their email where required. 

I am a complete noob with power automate and I am trying to see if there is something out there already that can help me. Ideally we need a flow which the user or potentially myself would be able to access, they would specify their leave and return date. The flow would them place them into the relevant security group for the duration of their travels. It would then remove them from the group at the specified return date. If anyone has any info I would be eternally grateful...

I think we can do something similar with PIM but that costs $$$ for P2 licensing.

[MRRV]

Removed

[mveenman]

Hi Gibbzie,

I’v made a powerapp, that is doing something like you are describing.

Users must do registration for a country outside of the Netherlands. Leave date (-1 day) and arrival date (+1 day).

We have 2 groups, country in de EU and for outside the EU. Inside EU countries are automatically approved and 1 day before leave date, the will be add to a special group for conditional access.

If your destination is not a EU country there must be a approval from a  person who check if the country is really save.

The user and IT department gets an update by mail of every step in the process.

Users can see all there registrations and what the status is of the registration. 

When the users get back the will automatically deleted,  1 day after,  from the group.

Also made a approval dashboard so you don’t have to go to a list.

The pictures are for Demo and Example. 

  

 

[Acropolis9064]

Could you not create a MS Form which people fill in when they are going away, that could then run through an approval flow and add them to the group?

You could then have a SharePoint list which you add an entry to at the same time as adding them to the group which has the UserID and GroupID as columns and a date to remove column.

Then create a scheduled flow to run everyday for entries where date to remove = todays date, loop through each one and remove the user from the group specified.

[gibbzie]

Thank you so much for the input, my knowledge on power is non-existent. 

Do you know if any examples I can find online that I could follow to implement this? Not asking for the entire solution, just something that follows the same sort of logic that I could follow along with.

[mveenman]

Sure, that was the first idea, but with a powerapp it is looking much better, we have more than 2000 people in or education environment, and for a one-time use Forms is an effective way, but I wanted looking good. Also, the app shows extra information for the user and the servicedesk. With Power automate is made 9 flows for this app, everything is done by a flow.  The only thing is when a user is going outside de EU, there must be a approval for the county or countries the user is going. I'm looking for making a flow that the country  will automatically passtrue to conditional acces for that user. But that is a nice to have. For now this app and flows are working great and is saving time. 

[mveenman]

Hi Gibbzie, ok, than I think you could better try to build 1 or 2 simple apps to get familiar with how Power apps/automate is working. That is the way i did it. From there you could go on. 

I made de app first thinking what do we need for information. User name, User account, Status registration, departure time, arrival time, if it is a EU coutry, Yes/No, if no fill in the non-EU country from a dropdownlist that has the countries from conditional acces. 

Than, later i thought it maby good that the users see there status, New, Request is being processed, Approved, Active, Deactivated and see there history of registrations. 

But as Acropolis9064 metioned, you could also do this with a MS Forms, that will use a sharepoint list, from there you can make some flows that will run at the background. Make a Form with the information you want, and import a sharepoint list from a test export Excel a the Forms, then make a flow from a template like "Record form responses in SharePoint" to get the data from that Forms to a Sharepoint list. From there you can make your own Flows from Sharepoint. 

The Choice what way you are collecting the data is yours. 

I don't know if i can make a export with the removal of the company names etc from the app and flows i made. I will give it a try, next week. 

[gibbzie]

Hey mveenman, 

Thank you so much for the info, it's much appreciated! It would be nice if there was a way to export the config without the specific info.  I will see if I can give it a bash!