Policies/NSP-SVC-LOC-01.psd1
|
@{ Id = 'NSP-SVC-LOC-01' Name = 'Service accounts only from trusted locations' Version = 1 Description = 'Blocks the service accounts in the tenant profile everywhere except trusted locations. They are excluded from the MFA policies, so this keeps them usable only from the office.' Notes = 'New with the module (2026-10-09), from the common baselines. Used in tenants with ServiceAccountLocations = TrustedOnly. The plan holds it until the profile has service accounts and the tenant has a trusted location.' Option = 'ServiceAccountLocations=TrustedOnly' DefaultState = 'reportOnly' Users = @{ IncludeUsers = @('{ServiceAccounts}') ExcludeUsers = @('{BreakGlass}') } Applications = @{ Include = @('All') } Locations = @{ Include = @('All') Exclude = @('AllTrusted') } Grant = @{ Operator = 'OR' BuiltInControls = @('block') } } |