Import Order Issue: Conditional Access Policies import attempts before Named Locations

[Wowereit]

When performing a bulk import, the tool attempts to import Conditional Access policies (folder: ConditionalAccess) before importing Named Locations (folder: NamedLocations).

Because the Named Locations do not yet exist in the tenant at that point, any Conditional Access policy referencing them fails with an "Invalid Location" error.

This indicates a flaw in the import sequence, not necessarily in the policy‑handling logic.
I’m not completely certain this is the root cause, but the behavior strongly suggests it.

[Micke-K]

Hello,

Can you show me some logs? This should not happen since Named Location has higher priority than Conditional Access.

You have to select both for import. It will not import Named Locations unless it is selected.

I did a test import:

Cheers

[Wowereit]

Hi, I have used this https://github.com/j0eyv/ConditionalAccessBaseline, The following policies failed to import: CA000, CA001, CA200, CA203, CA205, CA208, and CA301. This is the log:
Use settings in registry
#####################################################################################
Application started
#####################################################################################
PowerShell version: 5.1.26100.7462
PowerShell build: 10.0.26100.7462
PowerShell CLR: 4.0.30319.42000
PowerShell edition: Desktop
OS: Windows 10 Pro 10.0.26200.7462
Module Compare loaded successfully
Module Copy loaded successfully
Module Documentation loaded successfully
Module DocumentationCustom loaded successfully
Module DocumentationHTML loaded successfully
Module DocumentationMD loaded successfully
Module DocumentationWord loaded successfully
Module EndpointManager loaded successfully
Module EndpointManagerInfo loaded successfully
Module IntuneAppManagement loaded successfully
Module IntuneAssignments loaded successfully
Module IntuneFilterUsage loaded successfully
Module IntuneTools loaded successfully
Module MSALAuthentication loaded successfully
Module MSGraph loaded successfully
Trigger function Invoke-InitializeModule
Trigger Invoke-InitializeModule in Compare
Trigger Invoke-InitializeModule in Copy
Trigger Invoke-InitializeModule in Documentation
Trigger Invoke-InitializeModule in DocumentationCustom
Trigger Invoke-InitializeModule in DocumentationHTML
Trigger Invoke-InitializeModule in DocumentationMD
Trigger Invoke-InitializeModule in DocumentationWord
Trigger Invoke-InitializeModule in EndpointManager
Trigger Invoke-InitializeModule in EndpointManagerInfo
Trigger Invoke-InitializeModule in IntuneAssignments
Trigger Invoke-InitializeModule in IntuneFilterUsage
Trigger Invoke-InitializeModule in IntuneTools
Trigger Invoke-InitializeModule in MSALAuthentication
Loaded Microsoft.IdentityModel.Abstractions.dll version 6.35.0.41201
Loaded Microsoft.Identity.Client.dll version 4.67.2.0
Trigger Invoke-InitializeModule in MSGraph
Add settings and menu items
Change view to Intune Manager
Add MSAL App 14d82eec-204b-4c2f-b7e8-296a70dab67e https://login.microsoftonline.com/organizations/
Use Graph environment: graph.microsoft.com
Token received from Cache. Time (ms) 343
Get current user
Get profile picture
Get organization info
Trigger function Invoke-GraphAuthenticationUpdated
Trigger Invoke-GraphAuthenticationUpdated in EndpointManager
Trigger Invoke-GraphAuthenticationUpdated in MSGraph
Clear cached values
Activating View Intune Manager
Trigger function Invoke-ViewActivated
Trigger Invoke-ViewActivated in Compare
Trigger Invoke-ViewActivated in Copy
Trigger Invoke-ViewActivated in Documentation
Running latest version: 3.10.1
Trigger function Invoke-ShowMainWindow
Trigger Invoke-ShowMainWindow in Compare
Trigger Invoke-ShowMainWindow in Documentation
Import objects

---

Start bulk import

---

Import root folder: C:\GitHub\ConditionalAccessBaseline\Config
Import Scope (Tags) objects

Import Scope (Tags) objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\ScopeTags not found. Skipping import
Import Filters objects

Import Filters objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\AssignmentFilters not found. Skipping import
Import Role Definitions objects

Import Role Definitions objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\RoleDefinitions not found. Skipping import
Import Notifications objects

Import Notifications objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\Notifications not found. Skipping import
Import Authentication Strengths objects

Import Authentication Strengths objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\AuthenticationStrengths not found. Skipping import
Import ADMX Files objects

Import ADMX Files objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\ADMXFiles not found. Skipping import
Import Authentication Context objects

Import Authentication Context objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\AuthenticationContext not found. Skipping import
Import Named Locations objects

Import Named Locations objects

Token received from Cache. Time (ms) 22
Create AAD Group CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude
Token received from Cache. Time (ms) 20
Token received from Cache. Time (ms) 21
Create AAD Group CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude
Token received from Cache. Time (ms) 17
Token received from Cache. Time (ms) 18
Create AAD Group CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA - Exclude
Token received from Cache. Time (ms) 17
Token received from Cache. Time (ms) 17
Create AAD Group CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude
Token received from Cache. Time (ms) 17
Token received from Cache. Time (ms) 21
Create AAD Group CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude
Token received from Cache. Time (ms) 20
Token received from Cache. Time (ms) 17
Create AAD Group CA-BreakGlassAccounts - Exclude
Token received from Cache. Time (ms) 18
Token received from Cache. Time (ms) 21
Create AAD Group CA300-ServiceAccounts-IdentityProtection-AnyApp-AnyPlatform-MFA - Exclude
Token received from Cache. Time (ms) 17
Token received from Cache. Time (ms) 20
Create AAD Group CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist - Exclude
Token received from Cache. Time (ms) 19
Token received from Cache. Time (ms) 27
Create AAD Group CA301-ServiceAccounts-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUntrustedLocations - Exclude
Token received from Cache. Time (ms) 17
Token received from Cache. Time (ms) 23
Create AAD Group CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication - Exclude
Token received from Cache. Time (ms) 18
Token received from Cache. Time (ms) 20
Create AAD Group CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA - Exclude
Token received from Cache. Time (ms) 18
Token received from Cache. Time (ms) 22
Create AAD Group CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows - Exclude
Token received from Cache. Time (ms) 21
Token received from Cache. Time (ms) 24
Create AAD Group CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload - Exclude
Token received from Cache. Time (ms) 115
Token received from Cache. Time (ms) 20
Create AAD Group CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA - Exclude
Token received from Cache. Time (ms) 17
Token received from Cache. Time (ms) 21
Create AAD Group CA103-Admins-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser - Exclude
Token received from Cache. Time (ms) 19
Token received from Cache. Time (ms) 23
Create AAD Group APP_Microsoft365_E5
Token received from Cache. Time (ms) 19
Token received from Cache. Time (ms) 25
Create AAD Group CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskUser - Exclude
Token received from Cache. Time (ms) 17
Token received from Cache. Time (ms) 17
Create AAD Group CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices - Exclude
Token received from Cache. Time (ms) 18
Token received from Cache. Time (ms) 19
Create AAD Group APP_Microsoft365_E5_Dev
Token received from Cache. Time (ms) 18
Token received from Cache. Time (ms) 22
Create AAD Group CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms - Exclude
Token received from Cache. Time (ms) 17
Token received from Cache. Time (ms) 25
Create AAD Group CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ - Exclude
Token received from Cache. Time (ms) 21
Token received from Cache. Time (ms) 17
Create AAD Group CA206-Internals-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser - Exclude
Token received from Cache. Time (ms) 22
WARNING: Export folder for dependency ScopeTags not found
WARNING: Export folder for dependency AssignmentFilters not found
Import Named Locations object ALLOWED COUNTRIES - SERVICE ACCOUNTS
Token received from Cache. Time (ms) 23
Named Locations object imported successfully with id: 1043fdb7-1e24-4d14-8332-c63a390b75c3
Import Named Locations object ALLOWED COUNTRIES
Token received from Cache. Time (ms) 17
Named Locations object imported successfully with id: 18d6d37b-61a4-4e11-b4db-09152211296d
Import Applications objects

Import Applications objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\Applications not found. Skipping import
Import Reusable Settings objects

Import Reusable Settings objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\ReusableSettings not found. Skipping import
Import Compliance Scripts objects

Import Compliance Scripts objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\ComplianceScripts not found. Skipping import
Import Health Scripts objects

Import Health Scripts objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\DeviceHealthScripts not found. Skipping import
Import Feature Updates objects

Import Feature Updates objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\FeatureUpdates not found. Skipping import
Import Intune Branding objects

Import Intune Branding objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\IntuneBranding not found. Skipping import
Import Quality Updates objects

Import Quality Updates objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\QualityUpdates not found. Skipping import
Import Inventory Policies objects

Import Inventory Policies objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\InventoryPolicies not found. Skipping import
Import Update Policies objects

Import Update Policies objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\UpdatePolicies not found. Skipping import
Import Terms of use objects

Import Terms of use objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\TermsOfUse not found. Skipping import
Import W365 User Settings objects

Import W365 User Settings objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\W365UserSettings not found. Skipping import
Import W365 Provisioning Policies objects

Import W365 Provisioning Policies objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\W365ProvisioningPolicies not found. Skipping import
Import Scripts (Shell) objects

Import Scripts (Shell) objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\MacScripts not found. Skipping import
Import Scripts (PowerShell) objects

Import Scripts (PowerShell) objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\PowerShellScripts not found. Skipping import
Import Terms and Conditions objects

Import Terms and Conditions objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\TermsAndConditions not found. Skipping import
Import Settings Catalog objects

Import Settings Catalog objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\SettingsCatalog not found. Skipping import
Import Autopilot objects

Import Autopilot objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\AutoPilot not found. Skipping import
Import Apple Enrollment Types objects

Import Apple Enrollment Types objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\AppleEnrollmentTypes not found. Skipping import
Import BIOS Configurations objects

Import BIOS Configurations objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\HardwareConfigurations not found. Skipping import
Import Compliance Policies objects

Import Compliance Policies objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\CompliancePolicies not found. Skipping import
Import Co-Management Settings objects

Import Co-Management Settings objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\CoManagementSettings not found. Skipping import
Import Android OEM Config objects

Import Android OEM Config objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\AndroidOEMConfig not found. Skipping import
Import Administrative Templates objects

Import Administrative Templates objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\AdministrativeTemplates not found. Skipping import
Import App Configuration (App) objects

Import App Configuration (App) objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\AppConfigurationManagedApp not found. Skipping import
Import App Protection objects

Import App Protection objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\AppProtection not found. Skipping import
Import App Configuration (Device) objects

Import App Configuration (Device) objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\AppConfigurationManagedDevice not found. Skipping import
Import Driver Update Profiles objects

Import Driver Update Profiles objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\DriverUpdateProfiles not found. Skipping import
Import Device Configuration objects

Import Device Configuration objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\DeviceConfiguration not found. Skipping import
Import Endpoint Security objects

Import Endpoint Security objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\EndpointSecurity not found. Skipping import
Import Enrollment Status Page objects

Import Enrollment Status Page objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\EnrollmentStatusPage not found. Skipping import
Import Enrollment Restrictions objects

Import Enrollment Restrictions objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\EnrollmentRestrictions not found. Skipping import
Import Compliance Policies - V2 objects

Import Compliance Policies - V2 objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\CompliancePoliciesV2 not found. Skipping import
Import Conditional Access objects

Import Conditional Access objects

Token received from Cache. Time (ms) 18
WARNING: Could not find an exported 'Named Locations' object with name NL-Office-Absacon
WARNING: Export folder for dependency Applications not found
WARNING: Export folder for dependency TermsOfUse not found
WARNING: Export folder for dependency AuthenticationStrengths not found
Import Conditional Access object CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA
Token received from Cache. Time (ms) 17
Failed to invoke MS Graph with URL https://graph.microsoft.com/beta/identity/conditionalAccess/policies (Request ID: 4202d62e-c5b4-43eb-bdd3-ac9b87aadac6). Status code: BadRequest. Response message: The server could not process the request because it is malformed or incorrect. Exception: Fjernserveren returnerede en fejl: (400) Forkert anmodning.
Import Conditional Access object CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist
Token received from Cache. Time (ms) 19
Failed to invoke MS Graph with URL https://graph.microsoft.com/beta/identity/conditionalAccess/policies (Request ID: 0429d693-baf9-4e5e-8611-9f509c7d0a36). Status code: BadRequest. Response message: The server could not process the request because it is malformed or incorrect. Exception: Fjernserveren returnerede en fejl: (400) Forkert anmodning.
Import Conditional Access object CA002-Global-IdentityProtection-AnyApp-AnyPlatform-Block-LegacyAuthentication
Token received from Cache. Time (ms) 27
Conditional Access object imported successfully with id: 712a8124-8751-4040-84e4-8549beae3a62
Import Conditional Access object CA003-Global-BaseProtection-RegisterOrJoin-AnyPlatform-MFA
Token received from Cache. Time (ms) 17
Conditional Access object imported successfully with id: 7a345468-9ade-44b1-aa54-7303a69946e9
Import Conditional Access object CA004-Global-IdentityProtection-AnyApp-AnyPlatform-AuthenticationFlows
Token received from Cache. Time (ms) 21
Conditional Access object imported successfully with id: 7e084253-a67f-4791-885f-4de566051596
Import Conditional Access object CA005-Global-DataProtection-Office365-AnyPlatform-Unmanaged-AppEnforcedRestrictions-BlockDownload
Token received from Cache. Time (ms) 17
Conditional Access object imported successfully with id: 9492733a-c385-47c0-88df-a0c325656e6b
Import Conditional Access object CA006-Global-DataProtection-Office365-iOSenAndroid-RequireAppProtection
Token received from Cache. Time (ms) 17
Conditional Access object imported successfully with id: 71e0425c-4845-416e-b5b6-853d82f74dc7
Import Conditional Access object CA100-Admins-IdentityProtection-AdminPortals-AnyPlatform-MFA
Token received from Cache. Time (ms) 17
Conditional Access object imported successfully with id: ce36f21e-9283-4cf2-9890-f595870ee272
Import Conditional Access object CA101-Admins-IdentityProtection-AnyApp-AnyPlatform-MFA
Token received from Cache. Time (ms) 20
Conditional Access object imported successfully with id: 3b192639-81b6-4c82-b059-8b12d22a4981
Import Conditional Access object CA102-Admins-IdentityProtection-AllApps-AnyPlatform-SigninFrequency
Token received from Cache. Time (ms) 17
Conditional Access object imported successfully with id: 23c14528-4e9c-4286-a5a4-19cc84acb46d
Import Conditional Access object CA103-Admins-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser
Token received from Cache. Time (ms) 20
Conditional Access object imported successfully with id: 80acafbb-2d8f-414c-bba7-f6b5580c44ee
Import Conditional Access object CA104-Admins-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation
Token received from Cache. Time (ms) 17
Conditional Access object imported successfully with id: 12a0912b-8f08-4784-8653-ecf0ab261732
Import Conditional Access object CA105-Admins-IdentityProtection-AnyApp-AnyPlatform-PhishingResistantMFA
Token received from Cache. Time (ms) 20
Conditional Access object imported successfully with id: 11e61500-9140-4c70-a9bd-f7c89328e5f2
Import Conditional Access object CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA
Token received from Cache. Time (ms) 74
Failed to invoke MS Graph with URL https://graph.microsoft.com/beta/identity/conditionalAccess/policies (Request ID: 639942e2-7822-4453-8044-4a9282c5d62e). Status code: BadRequest. Response message: The server could not process the request because it is malformed or incorrect. Exception: Fjernserveren returnerede en fejl: (400) Forkert anmodning.
Import Conditional Access object CA201-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskUser
Token received from Cache. Time (ms) 18
Conditional Access object imported successfully with id: 4eae311b-1c92-4d88-9dfe-a57551b8413e
Import Conditional Access object CA202-Internals-IdentityProtection-AllApps-WindowsMacOS-SigninFrequency-UnmanagedDevices
Token received from Cache. Time (ms) 17
Conditional Access object imported successfully with id: cca49173-6489-4dc7-a650-7870b60fe8fb
Import Conditional Access object CA203-Internals-AppProtection-MicrosoftIntuneEnrollment-AnyPlatform-MFA
Token received from Cache. Time (ms) 22
Failed to invoke MS Graph with URL https://graph.microsoft.com/beta/identity/conditionalAccess/policies (Request ID: 7d624156-1405-4f74-bf8a-45fea5fd5f91). Status code: BadRequest. Response message: The server could not process the request because it is malformed or incorrect. Exception: Fjernserveren returnerede en fejl: (400) Forkert anmodning.
Import Conditional Access object CA204-Internals-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUnknownPlatforms
Token received from Cache. Time (ms) 20
Conditional Access object imported successfully with id: 3f688f29-1285-4961-9781-97a6cc959259
Import Conditional Access object CA205-Internals-BaseProtection-AnyApp-Windows-CompliantorAADHJ
Token received from Cache. Time (ms) 18
Failed to invoke MS Graph with URL https://graph.microsoft.com/beta/identity/conditionalAccess/policies (Request ID: 175927e4-8244-4099-950f-1a258a655722). Status code: BadRequest. Response message: The server could not process the request because it is malformed or incorrect. Exception: Fjernserveren returnerede en fejl: (400) Forkert anmodning.
Import Conditional Access object CA206-Internals-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser
Token received from Cache. Time (ms) 20
Conditional Access object imported successfully with id: 9f2d522d-446e-4e26-bb59-3f0ab3c4554f
Import Conditional Access object CA207-Internals-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK
Token received from Cache. Time (ms) 23
Conditional Access object imported successfully with id: 20a65b95-4949-419f-af13-d7f9b26154e6
Import Conditional Access object CA208-Internals-BaseProtection-AnyApp-MacOS-Compliant
Token received from Cache. Time (ms) 30
Failed to invoke MS Graph with URL https://graph.microsoft.com/beta/identity/conditionalAccess/policies (Request ID: f7b71861-a881-4b48-a5f8-8bef2386af14). Status code: BadRequest. Response message: The server could not process the request because it is malformed or incorrect. Exception: Fjernserveren returnerede en fejl: (400) Forkert anmodning.
Import Conditional Access object CA209-Internals-IdentityProtection-AllApps-AnyPlatform-ContinuousAccessEvaluation
Token received from Cache. Time (ms) 20
Conditional Access object imported successfully with id: a0d8d400-a58c-448a-90a5-eef431dac7b1
Import Conditional Access object CA210-Internals-IdentityProtection-AnyApp-AnyPlatform-BLOCK-HighRiskSignIn
Token received from Cache. Time (ms) 20
Conditional Access object imported successfully with id: 6facb5b8-2938-448a-9842-73dfd60e53ba
Import Conditional Access object CA300-ServiceAccounts-IdentityProtection-AnyApp-AnyPlatform-MFA
Token received from Cache. Time (ms) 17
Conditional Access object imported successfully with id: 794563fc-d327-4fcf-85a4-c0914c1e722b
Import Conditional Access object CA301-ServiceAccounts-AttackSurfaceReduction-AllApps-AnyPlatform-BlockUntrustedLocations
Token received from Cache. Time (ms) 17
Failed to invoke MS Graph with URL https://graph.microsoft.com/beta/identity/conditionalAccess/policies (Request ID: 866fc2db-0bbd-420c-bec3-f05d5d607235). Status code: BadRequest. Response message: The server could not process the request because it is malformed or incorrect. Exception: Fjernserveren returnerede en fejl: (400) Forkert anmodning.
Import Conditional Access object CA400-GuestUsers-IdentityProtection-AnyApp-AnyPlatform-MFA
Token received from Cache. Time (ms) 23
Conditional Access object imported successfully with id: 6835f53e-8e91-42d2-b7a9-e5898e5028bf
Import Conditional Access object CA401-GuestUsers-AttackSurfaceReduction-AllApps-AnyPlatform-BlockNonGuestAppAccess
Token received from Cache. Time (ms) 23
Conditional Access object imported successfully with id: e6169306-2ba7-4b34-95df-3b665bfe8a99
Import Conditional Access object CA402-GuestUsers-IdentityProtection-AllApps-AnyPlatform-SigninFrequency
Token received from Cache. Time (ms) 22
Conditional Access object imported successfully with id: 8854ed53-028e-4459-861f-3820b236e735
Import Conditional Access object CA403-GuestUsers-IdentityProtection-AllApps-AnyPlatform-PersistentBrowser
Token received from Cache. Time (ms) 18
Conditional Access object imported successfully with id: ec7c75e4-4d15-44c7-a79b-515d5d5eae7c
Import Conditional Access object CA404-GuestUsers-AttackSurfaceReduction-SelectedApps-AnyPlatform-BLOCK
Token received from Cache. Time (ms) 17
Conditional Access object imported successfully with id: 2666bf05-0e6b-4ba6-acb7-0f7736a02861
Import Device Categories objects

Import Device Categories objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\DeviceCategories not found. Skipping import
Import Custom Attributes objects

Import Custom Attributes objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\MacCustomAttributes not found. Skipping import
Import Policy Sets objects

Import Policy Sets objects

WARNING: Folder C:\GitHub\ConditionalAccessBaseline\Config\PolicySets not found. Skipping import

---

Bulk import finished

---

[Micke-K]

Hello,

Some could be license requirements eg E5 is expected. I have to test import all of them and see what I get.

It is usually that something is missing in the environment eg an app, role, group etc.

Are you trying this in a test environment or in a production with Intune?

Cheers!

[Wowereit]

Hi
I am seeing the same error in my own CA policies that use Exclude Location.
This occurs across multiple tenants, including my test tenant, and my colleagues are experiencing the same issue.
Could existing Named Locations in the tenant be the cause?

[Micke-K]

Hello,

Some of this was discuessed in this post: Issue 364

I fixed some of the issues in the Development branch.

In summary:

• CA000 - Failes because app 372140e0-b3b7-4226-8ef9-d57986796201 does not exist in the environment.
• CA001 - Failed because it failed to create the group. Should be fixed in the Development branch. It used to be missing a Named Location as well but that should be fixed in the ConditionalAccessBaselin repository.
• CA200 - Failes because app 372140e0-b3b7-4226-8ef9-d57986796201 does not exist in the environment.
• CA203 - Failes because app d4ebce55-015a-49b5-a083-c84d1797ae8c does not exist in the environment.
• CA205 - Failes because app d4ebce55-015a-49b5-a083-c84d1797ae8c does not exist in the environment.
• CA208 - Failes because app d4ebce55-015a-49b5-a083-c84d1797ae8c does not exist in the environment.
• CA301 - The info for the CA-ServiceAccounts group is missing in the MigrationTable.json
  @j0eyv - Was there an issue during the export?

Missing apps:
d4ebce55-015a-49b5-a083-c84d1797ae8c = Microsoft Intune Enrollment cloud app
372140e0-b3b7-4226-8ef9-d57986796201 = Azure Windows VM Sign-in

From Require multifactor authentication for Intune device enrollments:

If Windows Azure Windows VM Sign-in app is missing: Missing the Azure Windows VM Sign-in app

Missing group info
You can add this to the MigrationTable.json file.

{
    "DisplayName":  "CA-ServiceAccounts",
    "Id":  "77c1ed37-10d0-4ef1-93dc-198e70abb166",
    "Type":  "Group"
}

Cheers!

[j0eyv]

There was an update to the JSON files last week or the week before. This had no impact in my test situation. I was able to import the policies (JSON files) via Azure Portal and IntuneManagementTool without any issues.

The missing apps (as @Micke-K already described above) is an known issue. This and the required fix is described here: https://github.com/[j0eyv/ConditionalAccessBaseline](https://github.com/j0eyv/ConditionalAccessBaseline?tab=readme-ov-file#prerequisites)?tab=readme-ov-file#prerequisites

[Wowereit]

Hi
I have tested the Development branch, completed all prerequisites, and tried both the example CA policy from https://github.com/j0eyv and my own Conditional Access policy, but I still receive the same error.

Import Conditional Access object CA001-Global-AttackSurfaceReduction-AnyApp-AnyPlatform-BLOCK-CountryWhitelist
Token received from Cache. Time (ms) 20
Failed to invoke MS Graph with URL https://graph.microsoft.com/beta/identity/conditionalAccess/policies (Request ID: f86e6630-cc97-4643-9b77-7a42bd29d325). Status code: BadRequest. Response message: The server could not process the request because it is malformed or incorrect. Exception: Fjernserveren returnerede en fejl: (400) Forkert anmodning.

My own policy:

Import Conditional Access object 01 - Global - Block Non-Allowed Countries
Token received from Cache. Time (ms) 19
Failed to invoke MS Graph with URL https://graph.microsoft.com/beta/identity/conditionalAccess/policies (Request ID: 72139540-124f-445d-80e6-11678f3a2a17). Status code: BadRequest. Response message: The server could not process the request because it is malformed or incorrect. Exception: Fjernserveren returnerede en fejl: (400) Forkert anmodning.

At this point, I am mainly interested in getting Named Locations to import and work correctly.
Am I missing a required step or dependency?

[Micke-K]

Hello,

In the Bulk import log above, two named locations were imported.

How did you import the Conditional Access policies last time? Bulk or Single? In the same environment? Same exported folder structure?

Cheers!

[Wowereit]

Hi
The bulk import and this test are running in the same environment, but we are seeing the same error across multiple tenants.
The Named Locations are imported correctly, but the CA policy fails to create when the Named Location is used in the exclude section.

01 - Global - Block Non-Allowed Countries.json

[Micke-K]

I tried to import CA001 in my test environment and it works.

This used to fail because it failed to create the group. The development branch fixes that issue.

I cannot import your 01 policy because I don't have the MigrationTable, Named Location and Groups from that environment.

The import will require all these things in the export folder. The script uses the MigrationTable to identify group names, it uses the NamedLocation files to translate the Id in the Conditional Access json from the source to the destination environment e.g.

The CA001 policy has these group Ids:

• 6499f521-8620-4f4e-92a1-db47c79362e8
• 2802b872-ccfb-4b29-a9a9-459808dfb11b
• 813e2655-e8b9-4255-91f5-7761ee2824bb

And this Named Location

• 185c993e-10a9-44fa-98d1-230c8f72f497

The MigrationTable converts these Ids into a name. The script then lookup a group with the name in the destination environment. Changes the Id in the json to the Id of the group in the destination environment.

It then checks dependencies e.g. Named Location. Reads all Named location in the destination environment and creates a table with Id and Name. It then reads all json files in the NamedLocation folder and create a table with Id from the json and the Id in the destination tenant by checking the name in the json and the one in the destination tenant. It's basically a in memory translation table of exported id and the import id. The script then replaces all exported ids with destination tenant ids.

This means:

• The exported Named Location policies export folder must exist to allow translation of ids.
• The Named Location Policy must exist in the destination tenant with the same name.
• Bulk Import will create Named Locations first and add them to the in-memory translation table.
• Single json import will require that the Named Location is imported before the Conditional Access.

These are the basics of importing json file in a new tenant. So if it failed to create the group, the import would fail. If the Named Location policy is not there, it will fail to import Conditional Access. All ids in the json file must be translated into ids for objects in the destination tenant.

Bad Request (400) normally means that one or more of the exported ids were not translated into new ids. Graph will not allow importing a policy with id of an object that does not exist.

The easiest way to test is to remove one id (Group or Named Location) and then import. One id for each import and then identify which id that is not translated.

Cheers!

[Wowereit]

Okay, thank you :)
Here are the full packed, I will try to remove group or NL one at the time.

Conditional Access.zip