Travel Exemptions

Let employees request a temporary exemption from the Conditional Access policies that restrict sign-ins from abroad. After manager and/or IT approval, TATER adds them to your CA-exemption group around their departure date and removes them automatically when they return — a fully audited, time-boxed exception.

This grants a security exception

Being in the exemption group bypasses your travel Conditional Access controls, so exemptions are time-boxed to the trip window, require approval, are removed automatically, and every action is written to the audit log and surfaced in the Travel Exemption Activity Insights report.

How it works

Configure a CA-exemption group (once)

In Entra, create a security group and exclude it from the Conditional Access policies that block/limit foreign sign-ins. In TATER Manage → Approvals & Finance → Travel Exemptions, add a policy pointing at that group, set the max trip length, and choose whether manager and/or IT/security approval is required.

Employee requests a trip

In My TATER → My Travel the user picks the policy, enters their destination and departure/return dates, and submits.

Approval (configurable, sequential)

If manager approval is required, the user's manager (resolved from Entra, with a typed-in fallback) approves in My TATER. If IT/security approval is required, IT approves in TATER Ops → Travel Approvals. When both are on, it's manager first, then IT.

Granted for the trip, removed on return

The runbook adds the user to the exemption group around departure and removes them after the return date. The user is emailed when it goes active and when it's removed.

Approval model

Each policy independently sets require manager approval and require IT/security approval:

Both — sequential: the manager approves the business need, then IT/security approves the exception. (Recommended for higher-risk destinations.)
Manager only — the manager's approval grants it.
IT only — IT/security approves; no manager step.
Neither — auto-approved on request (use sparingly).

The manager is resolved from Entra (the user's manager relationship) via Microsoft Graph. If no manager is set, the requester is asked to provide their approving manager's email. IT/security approvers are a per-policy email list (falling back to org admins).

Runbook

Group membership is applied by the Manage-TravelExemptions Azure Automation runbook, which polls TATER, makes the group change with a privileged credential, and reports back. It reuses the same dedicated app registration and Automation variables as the License Rental runbook (Graph GroupMember.ReadWrite.All) — if you've set that up, drop this runbook in with no new configuration. Schedule it every ~15 minutes.

MCP tools

Tool	Purpose
`list_travel_policies`	List the travel policies a user can request against. Read-only.
`request_travel_exemption`	Request an exemption (destination + dates); on behalf of a user as Admin.
`list_travel_exemptions`	List exemptions — your own, awaiting your manager approval, or the org queue.
`approve_travel_exemption`	Approve at the current stage (manager or IT/security, by caller role).

Permissions & privacy

Any user can request travel for themselves; Admins can request on behalf of others.
Manager-stage approval requires being the requester's manager (or an admin); IT-stage requires an IT/security approver (or an admin).
Configuring travel policies requires Admin (TATER Manage).
Every request, approval, grant, and removal is audit-logged; active and historical exemptions appear in the Travel Exemption Activity Insights report.
The privileged group-write credential lives only in the runbook; TATER's scanning credential (read-only) is used only to resolve the manager and search groups for the picker.

License Rentals — the sibling module (same group-grant runbook + scheduler).
TATER Manage — where travel policies are configured.
Azure Runbooks — Automation account + runbook background.

Was this page helpful?