{
  "_comment": "Conditional Access Policy: MFA required for all users except break-glass. POST /identity/conditionalAccess/policies",
  "displayName": "CA01-MFA-Required-AllUsers",
  "state": "enabledForReportingButNotEnforced",
  "_stateNote": "本番展開時は 'enabled' に変更。まず report-only モードで影響範囲を確認する。",
  "conditions": {
    "users": {
      "includeUsers": [
        "All"
      ],
      "excludeUsers": [
        "<break-glass-account-1-object-id>",
        "<break-glass-account-2-object-id>"
      ],
      "includeGroups": [],
      "excludeGroups": [
        "<service-account-group-object-id>"
      ],
      "includeRoles": [],
      "excludeRoles": []
    },
    "applications": {
      "includeApplications": [
        "All"
      ],
      "excludeApplications": [
        "00000003-0000-0ff1-ce00-000000000000"
      ]
    },
    "clientAppTypes": [
      "all"
    ],
    "platforms": null,
    "locations": null,
    "signInRiskLevels": [],
    "userRiskLevels": []
  },
  "grantControls": {
    "operator": "OR",
    "builtInControls": [
      "mfa"
    ],
    "customAuthenticationFactors": [],
    "termsOfUse": []
  },
  "sessionControls": {
    "signInFrequency": {
      "value": 8,
      "type": "hours",
      "isEnabled": true,
      "_comment": "高権限ロールは 4h、一般ユーザーは 8h などロール別に分けるのが望ましい"
    },
    "persistentBrowser": {
      "mode": "never",
      "isEnabled": true
    }
  },
  "_checklist": [
    "Break-glass アカウントが excludeUsers に含まれているか",
    "MFA 登録キャンペーンが事前完了しているか",
    "report-only で 1 週間以上検証してから enabled へ移行",
    "サービスアカウント / 連携アプリの認証フロー影響を確認"
  ]
}