# Restrict Access To Microsoft Admin Portal > Restrict Access To Microsoft Admin Portal. Restrict Access To Microsoft Admin Portal. ## Settings this baseline controls | Setting | What it does | | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Policy name | Specifies a display name for the Conditional Access Policy [Learn more](https://learn.microsoft.com/en-us/entra/identity/conditional-access/how-to-policy-mfa-admin-portals) | | Enable policy | Specifies the state of the conditional Access Policy. Possible values are: enabled, disabled, enabledForReportingButNotEnforced. Required. [Learn more](https://learn.microsoft.com/en-us/entra/identity/conditional-access/how-to-policy-mfa-admin-portals) | | Included users | User IDs in scope of policy [Learn more](https://learn.microsoft.com/en-us/entra/identity/conditional-access/how-to-policy-mfa-admin-portals) | | Included roles | Role IDs in scope of policy [Learn more](https://learn.microsoft.com/en-us/entra/identity/conditional-access/how-to-policy-mfa-admin-portals) | | Included groups | Group IDs in scope of policy [Learn more](https://learn.microsoft.com/en-us/entra/identity/conditional-access/how-to-policy-mfa-admin-portals) | | Included guest types | Guest or external user types in scope of policy [Learn more](https://learn.microsoft.com/en-us/entra/identity/conditional-access/how-to-policy-mfa-admin-portals) | | Excluded users | User IDs excluded from scope of policy [Learn more](https://learn.microsoft.com/en-us/entra/identity/conditional-access/how-to-policy-mfa-admin-portals) | | Excluded roles | Role IDs excluded from scope of policy [Learn more](https://learn.microsoft.com/en-us/entra/identity/conditional-access/how-to-policy-mfa-admin-portals) | **5 more settings** | Setting | What it does | | ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Excluded groups | Group IDs excluded from scope of policy [Learn more](https://learn.microsoft.com/en-us/entra/identity/conditional-access/how-to-policy-mfa-admin-portals) | | Excluded guest types | Guest or external user types excluded from scope of policy [Learn more](https://learn.microsoft.com/en-us/entra/identity/conditional-access/how-to-policy-mfa-admin-portals) | | Grant controls | List of values of built-in controls required by the policy. Possible values: block, mfa, compliantDevice, domainJoinedDevice, approvedApplication, compliantApplication, passwordChange, unknownFutureValue [Learn more](https://learn.microsoft.com/en-us/entra/identity/conditional-access/how-to-policy-mfa-admin-portals) | | Included device platforms | Possible values are: android, iOS, windows, windowsPhone, macOS, linux, all, unknownFutureValue. [Learn more](https://learn.microsoft.com/en-us/entra/identity/conditional-access/how-to-policy-mfa-admin-portals) | | Included applications | The list of client IDs (appId) the policy applies to, unless explicitly excluded (in excludeApplications) All, Office365 - For the list of apps included in Office365. [Learn more](https://learn.microsoft.com/en-us/entra/identity/conditional-access/how-to-policy-mfa-admin-portals) | [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme. ## Configure it Add this baseline when Microsoft's admin portals (the Microsoft 365 admin centre, the Entra admin centre and the rest) should be closed to everyone except the admin roles or groups that need them. 1. Add the baseline to the tenant directly (see [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or carry it in a scheme you deploy to every tenant you manage (see [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)). 2. Leave **Included users** empty. This baseline scopes who's affected through **Included roles** or **Included groups** instead of a user list, so set one of those to your admin directory roles or admin groups. 3. Use **Excluded users**, **Excluded roles** or **Excluded groups** for break-glass accounts, so they can always reach the admin portals to recover access. 4. Leave **Grant controls** set to block. The baseline denies admin portal access outright to anyone in scope rather than adding a second factor. 5. **Save.** Turn on **Auto-remediation** if you want Octiga to reapply the policy whenever it's changed in Microsoft 365. End users outside the admin roles or groups you scoped it to see no change, since they have no reason to reach the admin portals. > **Caution:** Everyone you scope this to, other than your excluded break-glass accounts, loses admin portal access. Check your role and group scoping before you switch **Enable policy** on. > **Licence: Entra ID P1 or P2:** This baseline needs Entra ID P1 or P2 on the tenant. Without it, Octiga excludes the baseline rather than reporting it as deviated — see [Licence requirements](https://docs.octiga.io/reference/licence-requirements/). ## Check it worked After the next sync, this baseline shows **Passing** once a policy with `state` set to `enabled`, the block grant control, and the Microsoft Admin Portals resource target exists in Microsoft Entra. You can confirm it in the Microsoft Entra admin centre under **Entra ID > Conditional Access > Policies**. Anyone in scope who isn't excluded is refused sign-in to any Microsoft admin portal; everyone else notices nothing. ## Standards this addresses ### CIS - **M365 5.3.x** — CIS M365 Foundations Benchmark 5.3.x - **v8 5.4** — CIS Controls v8 Safeguard 5.4 - **v8 6.8** — CIS Controls v8 Safeguard 6.8 ### NIST - **PR.AC-4** — NIST CSF 2.0 PR.AC-4 - **AC-6** — NIST SP 800-53 AC-6 ### ISO 27001 - **A.8.2** — ISO/IEC 27001:2022 Annex A.8.2 **Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)