Choose which countries staff can sign in to Microsoft 365 from (Conditional Access)

Conditional Access rules control how and from where people can sign in to Microsoft 365. In the IT Solver dashboard you can see every rule, and you can choose which countries your staff can sign in from.

Before you start

• You must be an owner or IT manager of your business in the dashboard. See What each dashboard role can do.
• Your Microsoft 365 must be connected to the dashboard, with Microsoft access approved. See Connect the dashboard to your Microsoft 365.
• The dashboard can change countries only when your Microsoft 365 already has a country sign-in rule that is on. If you do not have one, ask IT Solver.

Open the Conditional Access page

1. Sign in at dashboard.itsolver.net.
2. In the sidebar, select Microsoft 365. If the sidebar shows Microsoft 365 tenant, select it.
3. Select the Conditional Access tab.

If there is no Conditional Access tab, connect Microsoft 365 first. See Connect the dashboard to your Microsoft 365. If you still do not see the tab, ask IT Solver.

What the page shows

• Policies: a table of every Conditional Access rule in your Microsoft 365. Each row shows the rule name and if it is On, Report-only or Off. It also shows who the rule Applies to, the apps, the Conditions (for example, the locations) and the Result (for example, Block or Require MFA). This table is view-only.
• Sign-in countries: people can sign in only from the countries in this section, unless a person has an exception.
• Organisation countries: a world map and the list of countries that everyone can sign in from.
• People outside the country rule: people who the country rule does not limit. The dashboard does not change them.
• Person exceptions: people who can also sign in from extra countries.

The sections that change countries show only when the country rule is on. They do not show while the rule is report-only, turned off, or does not protect any apps.

To change a rule other than the country rule, select Edit in Entra. This opens the Microsoft Entra admin centre. You need a Microsoft 365 admin account. If you are not sure, ask IT Solver to make the change.

Let a person sign in from another country

Use this when one or more people travel. Everyone else stays limited to the organisation countries.

1. Open the Conditional Access page.
2. Go to Allow a country for selected people.
3. In Country, select the country.
4. In People, select the person. To select more than one person, hold Ctrl (Windows) or Command (Mac) while you select.
5. Select Allow country for selected people.
6. Make sure that the person and the country show in Person exceptions.

Remove a person's extra country

1. Open the Conditional Access page.
2. In Person exceptions, find the person.
3. Select the End button with the country code, for example End JP for Japan.

The person can then sign in only from the organisation countries.

Allow or block a country for everyone

Use this only when the whole business needs the change. When one person travels, use a person exception.

Allow a country for everyone

1. Go to Change a country for everyone, then Allow for everyone.
2. In Country, select the country.
3. Select the box I understand every person will be able to sign in from this country.
4. Select Allow country for everyone.

If some people had this country as an exception, the dashboard removes those exceptions, because everyone now has the country.

Block a country for everyone

1. Go to Change a country for everyone, then Block for everyone.
2. In Country, select the country. The list shows only the current organisation countries.
3. Select Block country for everyone.

You must keep at least one organisation country. Do not remove Australia if people work in Australia, because they can lose access. Person exceptions stay in place.

Make the country rule cover all apps

If the country rule does not cover every Microsoft 365 app, or has no break-glass account, an owner sees Protect all apps. Only an owner can do this. An IT manager does not see this section.

This change makes the rule cover every app. If the rule is on, it then blocks sign-in to every app from countries that are not on the list. If the rule is report-only or turned off, it still does not block sign-in after this change. Ask IT Solver to turn it on. To make sure one account can still sign in if people are locked out, the dashboard creates a break-glass account. This is a Global Administrator account on your initial Microsoft domain (the one that ends in .onmicrosoft.com). The country rule does not apply to it.

1. Sign in to the dashboard with the code from your authenticator app. If you signed in another way, the dashboard shows Confirm your authenticator before creating a break-glass account. Sign out, then sign in again and enter the code from your authenticator app. See Set up an authenticator app for the dashboard.
2. Open the Conditional Access page.
3. In Protect all apps, select the box I understand this rule will start blocking sign-in from countries that are not on the organisation list.
4. Select the box Create a Global Administrator break-glass account and exclude it from this rule.
5. Select Protect all apps.
6. Copy the sign-in name and password from Break-glass account. Keep them in a safe place, such as a password manager. The dashboard does not show the password again.

If a red message at the top of the page says Approve Microsoft access before changing sign-in countries., the dashboard needs more Microsoft permissions for this step. A Microsoft 365 Global Administrator must approve Microsoft access. See Other messages. Then do the steps again.

When the rule covers all apps and has a break-glass account, the Protect all apps section no longer shows. If you lose the break-glass password, ask IT Solver.

Examples

A staff member is overseas and cannot sign in to Outlook

A staff member is in Japan for a conference. Outlook and Teams do not let them sign in.

To fix it: do the steps in Let a person sign in from another country and select Japan. Tell the staff member to try again. When they come home, do the steps in Remove a person's extra country. If they still cannot sign in, see Help a staff member who cannot sign in to Microsoft 365.

You hire a remote team in another country

Your business hires people who work full time from the Philippines.

To fix it: if only those people need it, add a person exception for each of them. If the whole business needs it, do the steps in Allow a country for everyone.

The page says "This rule is report-only. It does not block sign-in yet."

The rule only records sign-ins. It does not block them. The dashboard does not change the countries while the rule does not block sign-in. The same is true when the page says This rule is turned off. It does not block sign-in.

To fix it: ask IT Solver to check the rule and turn it on.

The page says "This rule does not protect any apps now."

The country rule is set up, but it does not cover any Microsoft 365 apps. It does not block sign-in, and the page does not show the sections that change countries.

To fix it: if you are an owner, do the steps in Make the country rule cover all apps. If you are an IT manager, ask an owner or IT Solver.

The page says "No country sign-in rule" or "This rule needs IT Solver"

Your Microsoft 365 has no country rule, or the rule is set up in a way that the dashboard cannot change safely.

To fix it: ask IT Solver to set up or check the rule. Tell us which countries your staff work from.

Other messages

• Approve sign-in country access or Approve Microsoft access before changing sign-in countries.: the dashboard needs more Microsoft permissions. Select Approve Microsoft access, if the page shows it. Then follow the steps in Connect the dashboard to your Microsoft 365 with a Microsoft 365 Global Administrator account. If there is no button, ask IT Solver.
• Someone changed these settings. Check the list and try again.: the rule changed after you opened the page. Read the lists again, then do the change again.
• This country list is shared with another Microsoft rule. Ask IT Solver for help.: the dashboard cannot change the organisation countries safely. Ask IT Solver.
• We could not confirm the change. No one can sign in from more places than before. Try again.: select the button again. If you see this message again, ask IT Solver.

Still have a problem?

Questions? Email support@itsolver.net or phone 07 3123 6000.