{
  "title": "Conditional access policy export",
  "exportedOn": "2026-06-29",
  "exportedBy": {
    "role": "Service Desk Lead",
    "person": "Lotte van Dijk"
  },
  "policies": [
    {
      "name": "Multi-factor authentication for every staff account",
      "appliesTo": "All staff accounts",
      "conditions": "Any sign-in to any company application",
      "control": "Require multi-factor authentication",
      "state": "enforced"
    },
    {
      "name": "Multi-factor authentication for privileged and remote access",
      "appliesTo": "Privileged accounts and every remote access path",
      "conditions": "Any sign-in, on or off the company network",
      "control": "Require multi-factor authentication and a managed device",
      "state": "enforced"
    },
    {
      "name": "Block legacy sign-in methods",
      "appliesTo": "All accounts",
      "conditions": "Protocols that cannot ask for a second factor",
      "control": "Block access",
      "state": "enforced"
    },
    {
      "name": "Separate privileged accounts",
      "appliesTo": "Privileged accounts held by the Service Desk Lead, the Change Manager, and the Incident Coordinator",
      "conditions": "Sign-in to anything other than administration consoles",
      "control": "Block access",
      "state": "enforced"
    },
    {
      "name": "Step-up for risky sign-ins",
      "appliesTo": "All staff accounts",
      "conditions": "Medium or high sign-in risk",
      "control": "Require a password change and multi-factor authentication",
      "state": "enforced"
    },
    {
      "name": "Sign-in from outside the Netherlands",
      "appliesTo": "All staff accounts",
      "conditions": "Location outside the Netherlands",
      "control": "Require multi-factor authentication and notify the Service Desk Lead",
      "state": "report-only"
    }
  ]
}