{
  "displayName": "CA003-Admins-RequirePhishResistantMFA",
  "state": "enabledForReportingButNotEnforced",
  "conditions": {
    "users": {
      "includeGroups": ["{group:CA-Persona-Admins}"],
      "includeRoles": [
        "62e90394-69f5-4237-9190-012177145e10",
        "e8611ab8-c189-46e8-94e1-60213ab1f814",
        "7be44c8a-adaf-4e2a-84d6-ab2649e08a13",
        "194ae4cb-b126-40b2-bd5b-6091b380977d",
        "b1be1c3e-b65d-4f19-8427-f6fa0d97feb9",
        "fe930be7-5e62-47db-91af-98c3a49a38b1",
        "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3",
        "158c047a-c907-4556-b7ef-446551a6b5f7",
        "8ac3fc64-6eca-42ea-9e69-59f4c7b60eb2",
        "29232cdf-9323-42fd-ade2-1d097af3e4de",
        "f28a1f50-f6e7-4571-818b-6a12f2af6b6c",
        "c4e39bd9-1100-46d3-8c65-fb160da0071f",
        "729827e3-9c14-49f7-bb1b-9608f156bbb8",
        "b0f54661-2d74-4c50-afa3-1ec803f12efe",
        "966707d0-3269-4727-9be2-8c3a10f19b9d"
      ],
      "excludeGroups": ["{group:CA-Exclude-EmergencyAccess}"]
    },
    "applications": { "includeApplications": ["All"] },
    "clientAppTypes": ["all"]
  },
  "grantControls": { "operator": "OR", "authenticationStrength": { "id": "{strength:FMP-Privileged-SeparateDevice}" } },
  "sessionControls": { "signInFrequency": { "isEnabled": true, "type": "hours", "value": 4, "frequencyInterval": "timeBased" } }
}
