We use Azure Virtual Desktop with a Conditional Access policy that blocks access from locations outside our approved office and home-country IP ranges. A second policy currently excludes members of a travel security group from that restriction, allowing those users to sign in from anywhere while traveling. We would like to make the exemption more specific: for example, a user traveling to Spain should be able to access AVD from Spain, but not from other countries. We do not want to add Spain to the general allowed locations because that would permit every user to connect from there. Is there a way to achieve this with a single Conditional Access policy, or does it require separate policies or another access workflow?
3 Answers
Device compliance can add another layer of protection. Require access from company-owned, managed, or compliant devices, then use the travel group for the temporary exception. That way, membership in the group alone does not allow an unmanaged device to sign in. This may not help if users need access from personal devices, though.
A country-specific exception generally needs separate policy logic rather than a single broad exclusion. The main block policy would need to exclude the travel group; otherwise, another policy granting access will not override the block. You could then target the travel group in a separate policy with the approved country as a location condition, but you should test the combined behavior carefully because Conditional Access policies are evaluated together. Privileged Identity Management could help with temporary elevation, but it requires the appropriate licensing and is not a direct replacement for location-based Conditional Access.
That licensing is the limitation for us—we do not have the required premium tier, so we would need to solve this with Conditional Access policies and group membership instead.
A practical approach is to use a travel request or approval process. When someone reports an approved trip, add them to the travel-exemption group, then remove them when they return. This is easier to manage than creating and maintaining country-specific rules, especially as the number of users and destinations grows. If you approve travel by destination, make sure users understand which countries are permitted.
Unfortunately, users also access email from personal phones, so requiring managed devices may not be workable for us. I think the design may need to exclude the travel group from the broad blocking policy, then apply a separate policy to that group with the approved country as the location condition.