NSP.M365.ConditionalAccess

0.1.0

Policies/NSP-BASE-PORTAL-01.psd1

                                @{

    Id = 'NSP-BASE-PORTAL-01'

    Name = 'Block Microsoft admin portals for non-administrators'

    Version = 1

    Description = 'Blocks the Microsoft admin portals (Entra, Microsoft 365, Exchange, Azure, Intune, and others) for everyone without an administrator role, guests included. Partner technicians signing in through GDAP (service providers) are not affected.'

    Notes = 'New with the module (2026-10-09), from the common baselines. Someone who uses the Azure portal with only an Azure (RBAC) role, or with an admin role not listed here, is blocked: report-only first shows them; exclude them on this policy.'

    DefaultState = 'reportOnly'

    Users = @{

        IncludeUsers = @('All')

        ExcludeUsers = @('{BreakGlass}', '{ServiceAccounts}')

        ExcludeGuestsOrExternalUsers = @('serviceProvider')

        ExcludeRoles = @(

            '{Role:ApplicationAdministrator}'

            '{Role:AuthenticationAdministrator}'

            '{Role:AuthenticationPolicyAdministrator}'

            '{Role:BillingAdministrator}'

            '{Role:CloudApplicationAdministrator}'

            '{Role:ConditionalAccessAdministrator}'

            '{Role:ExchangeAdministrator}'

            '{Role:HelpdeskAdministrator}'

            '{Role:PasswordAdministrator}'

            '{Role:PrivilegedAuthenticationAdministrator}'

            '{Role:PrivilegedRoleAdministrator}'

            '{Role:SecurityAdministrator}'

            '{Role:SharePointAdministrator}'

            '{Role:TeamsAdministrator}'

            '{Role:UserAdministrator}'

            '{Role:GlobalAdministrator}'

            '{Role:GlobalReader}'

            '{Role:SecurityReader}'

            '{Role:ReportsReader}'

            '{Role:IntuneAdministrator}'

            '{Role:CloudDeviceAdministrator}'

            '{Role:LicenseAdministrator}'

            '{Role:GroupsAdministrator}'

            '{Role:ComplianceAdministrator}'

            '{Role:ExchangeRecipientAdministrator}'

        )

    }

    Applications = @{

        Include = @('MicrosoftAdminPortals')

    }

    Grant = @{

        Operator = 'OR'

        BuiltInControls = @('block')

    }

}