Belajar IAM Engineer - Conditional Access & Policies
Risk-based access decisions, location dan device policies, serta otomasi conditional access menjadi pilar utama zero trust authentication
#Pendahuluan
Setelah di episode 16 kita membahas machine identity & AI, pada episode ini kita masuk ke conditional access & policies — sistem yang menentukan apakah user boleh mengakses resource berdasarkan konteks: lokasi, device, risk level, dan waktu. Conditional access adalah otak dari zero trust.
Mengapa conditional access penting? Karena "login = full access" sudah tidak relevan di era remote work dan cloud computing. Setiap request harus dinilai secara kontekstual — login dari kantor berbeda dengan login dari cafe di negara lain.
#Konsep Conditional Access
#Komponen
Signal → Decision → Grant/Deny
Signals:
- User identity & role
- Device compliance
- Location & IP
- Application sensitivity
- Risk level (sign-in risk, user risk)
Decisions:
- Allow
- Require MFA
- Require compliant device
- Block access
- Force password change#Flow Conditional Access
#Conditional Access di Entra ID
#Buat Policy
curl -X POST "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{
"displayName": "Require MFA for external access",
"state": "enabled",
"conditions": {
"applications": {
"includeApplications": ["All"]
},
"users": {
"includeGroups": ["all-users"]
},
"locations": {
"includeLocations": ["All"],
"excludeLocations": ["Trusted"]
}
},
"grantControls": {
"operator": "OR",
"builtInControls": ["mfa"]
}
}'#Policy Examples
| Policy | Kondisi | Aksi |
|---|---|---|
| MFA for admin | Role = Global Admin | Require MFA |
| Block legacy auth | Client = Legacy | Block |
| Compliant device | Device = Not compliant | Require compliant device |
| Trusted location | Location = Office | Allow without MFA |
| High risk sign-in | Risk = High | Require MFA + password change |
#Risk-Based Access
#Sign-in Risk
Risk assessment berdasarkan sinyal:
| Signal | Risk Indicators |
|---|---|
| Location | Negara yang tidak biasa, Tor exit node |
| Device | Unknown device, non-compliant |
| IP | Known malicious IP, VPN, proxy |
| Behavior | Impossible travel, unusual time |
#User Risk
Risk assessment berdasarkan aktivitas user:
| Indicator | Penjelasan |
|---|---|
| Leaked credentials | Password ditemukan di breach database |
| Anonymous IP | Login dari Tor atau anonymizer |
| Malware linked | Device terinfeksi malware |
| Suspicious activity | Perubahan perilaku signifikan |
curl -H "Authorization: Bearer $TOKEN" \
"https://graph.microsoft.com/v1.0/auditLogs/signIns?\$filter=riskLevel eq 'high'" \
| jq '.value[] | {user: .userPrincipalName, risk: .riskLevel, location: .location}'#Device Policies
#Device Compliance
| Setting | Policy |
|---|---|
| OS version | Minimum Windows 11, macOS 14 |
| Encryption | Full disk encryption wajib |
| Antivirus | Active & updated |
| Firewall | Enabled |
| Jailbreak detection | Block jailbroken devices |
#Device Trust
Device Registration → Compliance Check → Trust Evaluation
Trusted devices:
- Hybrid Azure AD joined
- Compliant with policies
- Certificate-based authenticationTip
Mulailah dengan conditional access policy sederhana: MFA untuk semua admin, block legacy auth, dan require compliant device untuk akses sensitif. Tambahkan complexity bertahap seiring matangnya implementasi zero trust.
#Policy Automation
#Automated Remediation
import requests
def remediate_high_risk_user(user_id, token):
headers = {'Authorization': f'Bearer {token}'}
# Force password reset
requests.post(
f'https://graph.microsoft.com/v1.0/users/{user_id}/resetPassword',
headers=headers,
json={'password': generate_temp_password()}
)
# Require MFA registration
requests.post(
f'https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies/{policy_id}/assignments',
headers=headers,
json={'target': user_id}
)#Penutup
Inti yang harus dibawa pulang:
- Conditional access menilai request berdasarkan konteks: user, device, location, risk.
- Risk-based access menggunakan sign-in risk dan user risk untuk decision-making.
- Device compliance policies memastikan hanya device sehat yang mengakses resource.
- Policy automation mempercepat remediation untuk risk tinggi.
Di episode 18 selanjutnya kita akan membahas identity threat detection — credential attacks, token abuse, dan UEBA. Siapkan deteksi ancaman identity kalian!