How can I use policy and variable overrides to block access from specific geographies for individual accounts?

You can create a global Conditional Access policy in Microsoft Intune, integrated with Nerdio Manager for MSP, to block access from specific geographic locations. By using a location variable, you can define a policy template, deploy it across multiple customer accounts, and manage it centrally for scalability.

For this, complete the following steps:

• Step 1: Create a named location and policy in Microsoft Intune

• Step 2: Import the policy to Nerdio Manager

• Step 3: Modify the imported location variable

• Step 4: Assign the policy to customer accounts

• Step 5: Adjust the variable for a customer account

Prerequisites

Ensure the following prerequisites are met:

• Modern Work features enabled in your customer account(s). This is required for policy management.

• Microsoft 365 Business Premium or higher, which includes Entra ID P1.

• A "golden" tenant Microsoft Intune environment for policy creation and import in Nerdio Manager.

• A named location (e.g., BlockedCountries) defined in Microsoft Intune.

• A Conditional Access policy that references this named location in its Block condition.

Step 1: Create a named location and policy in Microsoft Intune

First, create a named location and the template policy in your Microsoft Intune admin center.

To create the named location and policy:

1. Sign in to Microsoft Intune admin center.

2. Create the named location:

   1. Navigate to Endpoint Security > Conditional Access > Named locations.

   2. Select + Countries location.

      

   3. In the New location (Countries) pane, provide the following information:

      • Name: Enter a name, such as BlockedCountries, or any other name that meets your requirements.

      • Countries/Regions: Select the countries you wish to block initially. For details, see Reference: Country codes based on security risk levels.

   4. Select Create.

      

3. Create a policy template to be assigned globally (to all customer accounts and users):

   1. Navigate to Conditional Access > Policies, and select + New policy.

      

   2. Enter the following information:

      • Name: Enter Global_Block_HighRiskCountries or [GLOBAL] [ALL USERS] Block Access from High-Risk Countries.

        Example breakdown:

        • [GLOBAL]: Applies to all tenants.

        • [ALL USERS] : Applies to all users.

        • Title: Purpose of policy.

      • Users and groups: Select a group, pilot group, or users that you wish to assign.

      • Cloud apps or actions: Select All cloud apps.

      • Conditions: Under Locations, select Include > Selected locations, and then select the named location you created.

      • Grant: Select Block Access.

      • Enable policy: Set the policy to Report-only mode.

   3. Select Create.

      

Step 2: Import the policy to Nerdio Manager

The next step is to import your template policy to Nerdio Manager for centralized management. The location variable, included in that policy, is also imported to Nerdio Manager.

To import the policy:

1. In Nerdio Manager, at the MSP level, navigate to Policy Management > Conditional Access.

2. Select Import.

   

3. In the Import policies dialog box, provide the following information:

   • MSP: From the first drop-down list, select the tenant to import the policy from.

   • Available policy: Select your [Global] [ALL USERS] Block Access from High-Risk Countries policy.

   • Tags: Optionally, assign a tag for filtering.

   • Changelog: Enter a note like v1 - initial import.

     

4. Select Import.

To verify the name of the location variable:

1. Navigate to Policy Management > Conditional Access.

2. From the action menu next to the imported policy, select Edit.

3. On the Settings tab, locate and verify the variable name.

   

Step 3: Modify the imported location variable

Location variables in Nerdio Manager let you define reusable values (such as geographic regions or named locations) at the global MSP level, and apply them across customer accounts and policies. Creating these variables centrally lets you manage the list of blocked countries for all assigned customers from one place in Nerdio Manager.

If customization is needed, you can override this variable at the customer account level as described in Step 5: Adjust the variable for a customer account.

To modify the country list in the variable:

1. In Nerdio Manager, at the MSP level, navigate to Settings > Integrations.

2. In the Variables tile, find the location variable that corresponds to your named location. For example, BlockedCountries - [Global] StrictNoAccessCountryList.

   Note: The location variable is imported directly from Microsoft, given a randomly assigned name and a unique identifier. It cannot be modified.

   

3. Next to the variable, select edit.

4. In the Edit location variable dialog box, do the following:

   • Display name: Optionally, update the variable name to be displayed in the named location.

   • Countries/Regions: Add or remove country codes. Use the comma-separated country codes from the reference table in Reference: Country codes based on security risk levels.

5. Select Save.

   

This change applies to the Conditional Access policy and affects all customer accounts where the policy is assigned and hasn't been overridden.

Step 4: Assign the policy to customer accounts

Finally, assign the global, MSP-level policy to your customer account(s).

To assign the policy to a customer account:

1. In Nerdio Manager, at the MSP level, navigate to Policy Management > Conditional Access.

2. Find your [Global] Block Access from High-Risk Countries policy and select Assign next to it.

   

3. On the Assignments tab, select Add assignments.

4. In the new dialog box, select the customer account(s) you wish to assign this policy to.

   

5. Select one of the following:

   • Overwrite: To update an existing assignment, given it already exists.

   • Add: To create a new assignment.

6. Select Confirm.

7. Define the following options based on your current phase:

   • State: Select whether you want the policy to be Report Only, Enabled, Disabled, or Keep policy state as in source.

     Tip: For testing purposes, select Report Only.

   • Sync Type: Select Manual.

   • Direct Assign: Select Custom. This sets the group membership to None. Assignments must be made within the customer account.

   • Version: Select Latest or your current version.

     

8. Select Apply and Close.

Step 5: Adjust the variable for a customer account

Adjust the variable in your customer account to override the MSP-level value and reflect a unique list of countries.

To adjust the variable for a customer account:

1. At the account level, navigate to Settings > Integrations.

2. In the Variables tile, next to the variable you wish to adjust, select override.

3. In the new dialog box, in the Value field, specify a custom country list that applies only to this customer account.

   

4. Remove or add country codes based on the country list in Reference: Country codes based on security risk levels, then follow the Managing Conditional Access Policy template.

   Tip: Use CTRL+F to find the required country code.

5. Select Re-publish policies assigned to this customer that contain this variable to rebuild the policies for this customer account. Only policies that contain this variable are rebuilt.

   Note that clearing this option automatically removes the following option.

6. Select Also re-publish policies that have manual sync enabled to enforce this policy replication to the tenant, and activate it manually.

   

   The following JSON is configured to block High and Moderate countries from the reference table below.

   

7. Navigate back to Named locations and verify the country code is added or removed from the list.

   Note: It may take a few minutes to sync back to the Microsoft Admin Center.

   

Reference: Country codes based on security risk levels

This reference table provides a comprehensive list of countries along with their corresponding country codes and assigned security risk levels.

See also:

• Global Peace Index 2025, Institute for Economics & Peace

• International SOS Risk Outlook 2025

• FATF Grey and Blacklists, February 2025