We use Azure Virtual Desktop with Conditional Access policies that block sign-ins from locations outside our approved office or home-country locations. We also have a travel-exemption policy that excludes members of a security group from the location block, allowing them to connect while abroad. However, that exemption currently applies from every location.
We would like to make the exemption more specific. For example, if a user is travelling to Spain and belongs to an "AVD Exclusions - Travel" group, they should be allowed to access AVD only while connecting from Spain. Spain should not be added as a generally approved location, because that would allow every user to connect from there.
Is it possible to achieve this with a single Conditional Access policy, or would it require separate policies or another access-control process?
4 Answers
The proposed two-policy design is the direction to investigate: exclude the travel group from the broad location block, then apply a separate location-based policy specifically to that group and the approved country. Test the policy interactions carefully, since Conditional Access policies combine rather than override one another, and verify the result with sign-in logs before deploying it broadly.
You can also strengthen the exception by requiring a company-managed, domain-joined, or compliant device. The user may be in the travel group, but sign-in will still fail from an unmanaged personal device. This gives you an additional safeguard even when the location exemption is active.
A practical approach is to use a travel request and approval process. Once the trip is approved, add the user to a dedicated travel-exemption group, then remove them from it when they return. This is easier to audit and manage than continually creating country-specific exceptions, especially if users visit several countries during one trip. Make sure the approved-country rules and limitations are clearly communicated.
Privileged Identity Management is not really a substitute for this type of location-based access control. It would only be relevant if you had the required licensing and were trying to manage temporary privileged-role activation, rather than ordinary AVD sign-in access.
We do not have the required premium licensing, so PIM is not available for this setup.
That would be useful, but users also access email from personal phones, so requiring managed devices is not currently an option for us. I’m considering excluding the travel group from the main location policy and creating a separate policy aimed only at that group, with Spain—or the relevant approved country—as the included location.