Template requirements
Applies to: Conditional Access templates (group requirements also apply to Defender templates).
Where: Secure → Conditional Access → Templates → edit a template.
You need: Manage permission on Secure.
BETA. Template requirements are enabled per organisation. To join the beta, email support@augmentt.com and ask for Conditional Access template requirements to be turned on.
A requirement is a per-tenant object the policy depends on, recorded on the template by name instead of by tenant ID. At deployment Augmentt looks the name up in the target tenant, uses what it finds, creates what is missing, and binds the policy to the result. You stop pre-building the same "Admin Users" group and "Corporate Offices" location in forty tenants, and you stop re-picking them on every deploy.
Requirement types
Type | Template fields it can fill | Created when missing? | What the template stores |
|---|---|---|---|
Group | Include Groups, Exclude Groups (CA); recipient and exception scoping (Defender) | Yes | Name and group type; the membership rule for a dynamic group |
Named location | Include Locations, Exclude Locations | Yes | Name, type (IP ranges or Countries), the ranges or countries, the lookup method, and the Trusted flag |
User | Include Users, Exclude Users | No — matched by UPN only | The user principal name |
Workload identity | Include / exclude workload identities | No — matched by name only | The service principal's display name |
A template can carry several requirements. Fields that are not set to resolve automatically still prompt you at deployment exactly as before, so existing templates are unaffected.