🔷 Microsoft Graph Conditional Access Policy Terraform Module

module "require_mfa" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-conditional-access-policy.git?ref=v1.0.0"

  display_name = "Require MFA — pilot group"

  conditions = {
    users = {
      include_groups = [var.pilot_group_object_id]
    }
  }

  grant_controls = {
    operator          = "OR"
    built_in_controls = ["mfa"]
  }
}

module "require_mfa_enforced" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-conditional-access-policy.git?ref=v1.0.0"

  display_name = "Require MFA — all users (enforced)"
  state        = "enabled" # deliberate opt-out of the report-only secure default

  conditions = {
    users = {
      include_users = ["All"]
      exclude_users = var.break_glass_user_ids # never lock yourself out — see example 14
    }
  }

  grant_controls = {
    operator          = "OR"
    built_in_controls = ["mfa"]
  }
}

module "block_legacy_auth" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-conditional-access-policy.git?ref=v1.0.0"

  display_name = "Block legacy authentication"
  state        = "enabled"

  conditions = {
    users = {
      include_users = ["All"]
      exclude_users = var.break_glass_user_ids
    }
    # Legacy auth surfaces as these two client app types.
    client_app_types = ["exchangeActiveSync", "other"]
  }

  grant_controls = {
    operator          = "OR"
    built_in_controls = ["block"]
  }
}

module "risky_signin_mfa" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-conditional-access-policy.git?ref=v1.0.0"

  display_name = "Require MFA for medium/high sign-in risk"
  state        = "enabled"

  conditions = {
    users = {
      include_users = ["All"]
      exclude_users = var.break_glass_user_ids
    }
    sign_in_risk_levels = ["high", "medium"] # requires Entra ID P2 Identity Protection at apply
  }

  grant_controls = {
    operator          = "OR"
    built_in_controls = ["mfa"]
  }
}

module "risky_user_mfa" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-conditional-access-policy.git?ref=v1.0.0"

  display_name = "Require MFA for high user risk"
  state        = "enabled"

  conditions = {
    users = {
      include_users = ["All"]
      exclude_users = var.break_glass_user_ids
    }
    user_risk_levels = ["high"] # requires Entra ID P2
  }

  grant_controls = {
    operator          = "OR"
    built_in_controls = ["mfa"]
  }
}

module "block_untrusted_locations" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-conditional-access-policy.git?ref=v1.0.0"

  display_name = "Block access from untrusted locations"
  state        = "enabled"

  conditions = {
    users = {
      include_users = ["All"]
      exclude_users = var.break_glass_user_ids
    }
    locations = {
      include_locations = ["All"]
      exclude_locations = ["AllTrusted"] # or specific named-location ids from terraform-msgraph-named-location
    }
  }

  grant_controls = {
    operator          = "OR"
    built_in_controls = ["block"]
  }
}

module "require_phishing_resistant" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-conditional-access-policy.git?ref=v1.0.0"

  display_name = "Require phishing-resistant MFA — admins"
  state        = "enabled"

  conditions = {
    users = {
      include_roles = var.privileged_role_template_ids
      exclude_users = var.break_glass_user_ids
    }
  }

  grant_controls = {
    operator                   = "AND"
    authentication_strength_id = var.phishing_resistant_strength_id # from terraform-msgraph-authentication-strength-policy
    # NOTE: do NOT also set built_in_controls = ["mfa"] — an authentication strength and mfa are mutually
    # exclusive and this combination fails at plan (precondition rule 5).
  }
}

module "user_risk_password_change" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-conditional-access-policy.git?ref=v1.0.0"

  display_name = "High user risk — require secure password change"
  state        = "enabled"

  conditions = {
    users = {
      include_users = ["All"]
      exclude_users = var.break_glass_user_ids
    }
    user_risk_levels = ["high"] # mandatory for a passwordChange policy
    # No other conditions may be set (rule 4). applications defaults to ["All"]; client_app_types stays ["all"].
  }

  grant_controls = {
    operator          = "AND"                     # mandatory for passwordChange (rule 2)
    built_in_controls = ["passwordChange", "mfa"] # passwordChange must pair with mfa (rule 2)
  }
}

module "require_risk_remediation" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-conditional-access-policy.git?ref=v1.0.0"

  display_name = "High user risk — require remediation"
  state        = "enabled"

  conditions = {
    users = {
      include_users = ["All"]
      exclude_users = var.break_glass_user_ids
    }
    user_risk_levels = ["high", "medium"]
  }

  grant_controls = {
    operator                   = "AND" # mandatory for riskRemediation (rule 3)
    built_in_controls          = ["riskRemediation"]
    authentication_strength_id = var.phishing_resistant_strength_id # mandatory pairing (rule 3)
  }
}

module "require_managed_device" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-conditional-access-policy.git?ref=v1.0.0"

  display_name = "Require managed device"
  state        = "enabled"

  conditions = {
    users = {
      include_groups = [var.workforce_group_id]
      exclude_users  = var.break_glass_user_ids
    }
  }

  grant_controls = {
    operator          = "OR" # satisfy EITHER control
    built_in_controls = ["compliantDevice", "domainJoinedDevice"]
  }
}

module "mobile_browser_mfa" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-conditional-access-policy.git?ref=v1.0.0"

  display_name = "MFA for browser access on mobile platforms"
  state        = "enabled"

  conditions = {
    users = {
      include_users = ["All"]
      exclude_users = var.break_glass_user_ids
    }
    client_app_types = ["browser"]
    platforms = {
      include_platforms = ["iOS", "android"]
    }
  }

  grant_controls = {
    operator          = "OR"
    built_in_controls = ["mfa"]
  }
}

module "guest_mfa" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-conditional-access-policy.git?ref=v1.0.0"

  display_name = "Require MFA for B2B guests"
  state        = "enabled"

  conditions = {
    users = {
      include_guests_or_external_users = {
        guest_or_external_user_types = ["b2bCollaborationGuest", "b2bCollaborationMember"]
        external_tenants = {
          membership_kind = "all"
        }
      }
    }
  }

  grant_controls = {
    operator          = "OR"
    built_in_controls = ["mfa"]
  }
}

module "workload_identity_risk" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-conditional-access-policy.git?ref=v1.0.0"

  display_name = "Block high-risk workload identities"
  state        = "enabled"

  conditions = {
    # client_applications instead of users — exactly one of the two (precondition rule 6).
    client_applications = {
      include_service_principals = var.monitored_service_principal_ids
    }
    service_principal_risk_levels = ["high"] # note: smaller enum than user risk — no "hidden"
  }

  grant_controls = {
    operator          = "OR"
    built_in_controls = ["block"]
  }
}

# A house pattern, not a special feature: every enforced policy above threads var.break_glass_user_ids
# into exclude_users so a misconfigured policy can never lock every administrator out at once.
variable "break_glass_user_ids" {
  type        = list(string)
  description = "Object ids of the tenant's emergency-access accounts, excluded from every enforced policy."
}

module "enforced_baseline" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-conditional-access-policy.git?ref=v1.0.0"

  display_name = "Baseline — require MFA (with break-glass exclusion)"
  state        = "enabled"

  conditions = {
    users = {
      include_users = ["All"]
      exclude_users = var.break_glass_user_ids
    }
  }

  grant_controls = {
    operator          = "OR"
    built_in_controls = ["mfa"]
  }
}

# A security group whose members the policy targets (published module).
module "engineering_group" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-group.git?ref=v1.0.0"

  display_name  = "Engineering"
  mail_nickname = "engineering"
  group_type    = "security"
}

# A named location the policy scopes to (PLANNED sibling —.id is the intended contract).
module "branch_office" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-named-location.git?ref=v1.0.0"

  display_name = "Branch office egress"
  ip_ranges    = ["203.0.113.0/24"]
}

# A custom authentication strength the policy requires (PLANNED sibling —.id is the intended contract).
module "phishing_resistant" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-authentication-strength-policy.git?ref=v1.0.0"

  display_name         = "Phishing-resistant MFA"
  allowed_combinations = ["fido2", "windowsHelloForBusiness", "x509CertificateMultiFactor"]
}

# This module consumes all three by id — Terraform's dependency graph creates them first, with no depends_on.
module "engineering_strong_auth" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-conditional-access-policy.git?ref=v1.0.0"

  display_name = "Require phishing-resistant MFA — Engineering from branch office"
  state        = "enabled"

  conditions = {
    users = {
      include_groups = [module.engineering_group.id] # conditions.users.includeGroups
      exclude_users  = var.break_glass_user_ids
    }
    locations = {
      include_locations = [module.branch_office.id] # conditions.locations.includeLocations
    }
  }

  grant_controls = {
    operator                   = "AND"
    authentication_strength_id = module.phishing_resistant.id # grantControls.authenticationStrength.id
  }
}

variable "display_name" { type = string } # required, 1–256 chars

variable "state" {
  type    = string
  default = "enabledForReportingButNotEnforced" # "enabled" | "disabled" | "enabledForReportingButNotEnforced"
}

variable "conditions" {
  type = object({
    applications = optional(object({
      include_applications = optional(list(string), ["All"]) # app ids, or "All"/"Office365"/"MicrosoftAdminPortals"
      exclude_applications = optional(list(string), [])
      application_filter   = optional(object({ mode = string, rule = string })) # mode: "include"|"exclude"
      include_user_actions = optional(list(string), [])                         # only urn:user:registersecurityinfo / urn:user:registerdevice
    }), {})

    users = optional(object({
      include_users  = optional(list(string), []) # user ids, or "None"/"All"/"GuestsOrExternalUsers"
      exclude_users  = optional(list(string), [])
      include_groups = optional(list(string), [])
      exclude_groups = optional(list(string), [])
      include_roles  = optional(list(string), [])
      exclude_roles  = optional(list(string), [])
      include_guests_or_external_users = optional(object({
        guest_or_external_user_types = list(string) # flags enum (see legal values)
        external_tenants             = optional(object({ membership_kind = string, members = optional(list(string), []) }))
      }))
      exclude_guests_or_external_users = optional(object({
        guest_or_external_user_types = list(string)
        external_tenants             = optional(object({ membership_kind = string, members = optional(list(string), []) }))
      }))
    }))

    client_applications = optional(object({
      include_service_principals = optional(list(string), []) # sp ids, or "ServicePrincipalsInMyTenant"
      exclude_service_principals = optional(list(string), [])
      service_principal_filter   = optional(object({ mode = string, rule = string }))
    }))

    client_app_types = optional(list(string), ["all"]) # all|browser|mobileAppsAndDesktopClients|exchangeActiveSync|easSupported|other

    platforms = optional(object({
      include_platforms = optional(list(string), []) # android|iOS|windows|windowsPhone|macOS|linux|all|unknownFutureValue
      exclude_platforms = optional(list(string), [])
    }))

    locations = optional(object({
      include_locations = optional(list(string), []) # named-location ids, or "All"/"AllTrusted"
      exclude_locations = optional(list(string), [])
    }))

    devices = optional(object({
      device_filter = object({ mode = string, rule = string })
    }))

    sign_in_risk_levels           = optional(list(string), [])                            # low|medium|high|hidden|none|unknownFutureValue (P2)
    user_risk_levels              = optional(list(string), [])                            # low|medium|high|hidden|none|unknownFutureValue (P2)
    service_principal_risk_levels = optional(list(string), [])                            # low|medium|high|none|unknownFutureValue (no "hidden")
    insider_risk_levels           = optional(string)                                      # SCALAR: minor|moderate|elevated|unknownFutureValue
    authentication_flows          = optional(object({ transfer_methods = list(string) })) # none|deviceCodeFlow|authenticationTransfer|unknownFutureValue
  })
}

variable "grant_controls" {
  type = object({
    operator                      = optional(string, "OR")     # "AND" | "OR"
    built_in_controls             = optional(list(string), []) # block|mfa|compliantDevice|domainJoinedDevice|approvedApplication|compliantApplication|passwordChange|riskRemediation
    custom_authentication_factors = optional(list(string), [])
    terms_of_use                  = optional(list(string), [])
    authentication_strength_id    = optional(string)
  })
  default = null
}