{
  "displayName": "CA015-ServiceAccounts-LocationRestriction",
  "state": "enabledForReportingButNotEnforced",
  "conditions": {
    "clientApplications": { "includeServicePrincipals": ["{scope:ring}"] },
    "applications": { "includeApplications": ["All"] },
    "locations": { "includeLocations": ["All"], "excludeLocations": ["{location:NL-WorkloadEgress}"] },
    "clientAppTypes": ["all"]
  },
  "grantControls": { "operator": "OR", "builtInControls": ["block"] }
}
