{
  "id": "cap-spec425",
  "displayName": "Require MFA",
  "state": "enabled",
  "conditions": {
    "users": {
      "includeUsers": ["All"]
    },
    "applications": {
      "includeApplications": ["Office365"]
    },
    "clientAppTypes": ["browser"],
    "devices": {
      "includeDeviceStates": ["compliant"],
      "excludeDeviceStates": ["domainJoined"],
      "deviceFilter": {
        "mode": "include",
        "rule": "device.trustType -eq \"AzureAD\""
      }
    }
  },
  "grantControls": {
    "operator": "OR",
    "builtInControls": ["mfa"]
  },
  "sessionControls": {
    "signInFrequency": {
      "value": 8,
      "type": "hours",
      "isEnabled": true
    }
  }
}