Private/Get-NSPConditionalAccessHomeCountryDefinition.ps1
|
function Get-NSPConditionalAccessHomeCountryDefinition { <# .SYNOPSIS Generates report-only geographic restrictions for permanent home country groups. #> [CmdletBinding()] param([Parameter(Mandatory)]$TenantProfile) foreach ($entry in @(Get-NSPConditionalAccessHomeCountryEntry $TenantProfile | Where-Object Status -eq 'Active')) { @{ Id = $entry.PolicyId Name = "Home countries: $($entry.Name)" Version = 1 Description = 'Blocks this group outside its permanent home countries; enforced travel policies take over for travelers.' DefaultState = 'reportOnly' Users = @{ IncludeGroups = @("{HomeGroup:$($entry.Key)}") ExcludeUsers = @('{BreakGlass}', '{ServiceAccounts}') ExcludeGroups = @('{TravelGroups:Enforced}') } Applications = @{ Include = @('All') } Locations = @{ Include = @('All'); Exclude = @($entry.Countries | ForEach-Object { "{Country:$_}" }) } Grant = @{ Operator = 'OR'; BuiltInControls = @('block') } } } } |