Conditional Access Named Locations: Set Up Trusted IPs and Countries

A named location in Microsoft Entra is a saved set of IP ranges or countries that Conditional Access policies can include or exclude. To set one up, open the Microsoft Entra admin center, go to Entra ID > Conditional Access > Named locations, create an IP ranges or countries location, optionally mark it as trusted, and then select it in the Network condition of a policy.

Who this is for and what you will have

This guide is for Entra administrators who want to require multifactor authentication only off the corporate network, or block sign-ins from countries where the organisation never operates. By the end you will have a trusted IP location for your office or egress addresses, a country location for blocking, and a clear idea of what the location condition can and cannot see.

Prerequisites

• An account with at least the Conditional Access Administrator role, which Microsoft documents as sufficient to create and update named locations.
• Your organisation's public egress IP addresses, not internal addresses. For devices on a private network, the address that matters is the one the network uses to reach the internet, such as 198.51.100.3, not an intranet address such as 10.55.99.3.
• At least one emergency access account that you will exclude from any blocking policy. See Conditional Access Break-Glass Accounts.

How Entra determines location

Entra determines a user's location from their public IP address, or from GPS coordinates provided by the Microsoft Authenticator app when you configure a country location that way. Conditional Access policies apply to all locations by default, so you narrow the scope by adding the Network condition. The condition was formerly called Location, and Microsoft notes that existing policies continue to work without changes.

Conditional Access policies are enforced after first-factor authentication is complete. They are not designed as a front line against denial of service attacks, but they can use signals from such events to decide access.

Create an IP ranges named location

1. Sign in to the Microsoft Entra admin center.
2. Browse to Entra ID > Conditional Access > Named locations.
3. Create a new IP ranges location.
4. Enter a Name, such as Contoso HQ egress.
5. Add one or more public IP ranges in CIDR notation.
6. Select Mark as trusted location if the range is a network you control, then save.

IPv6 ranges must be entered in CIDR notation. Microsoft's examples are a single address 2001:db8::1/128 and a subnet 2001:db8:abcd:0012::/64.

IP location limits

What marking a location as trusted does

Admins can mark IP-based locations, such as your organisation's public network ranges, as trusted. Microsoft documents two effects: Conditional Access policies can include or exclude these locations, and sign-ins from trusted named locations improve the accuracy of Microsoft Entra ID Protection's risk calculation. A location marked as trusted cannot be deleted without first removing the trusted designation.

Trusted is a label, not a security guarantee. Treat any range you mark carefully, because every address in it gets the relaxed treatment you design for trusted networks.

Create a countries named location

1. In Named locations, create a new countries location.
2. Enter a Name, such as Countries we never operate in.
3. Choose Determine location by IP address or Determine location by GPS coordinates.
4. Add one or more countries or regions.
5. Optionally select Include unknown countries/regions.

IP address versus GPS

With Determine location by IP address, Entra resolves the user's IPv4 or IPv6 address to a country or region using a periodically updated mapping table. This works with no client requirements.

Determine location by GPS coordinates needs the Microsoft Authenticator app on the user's mobile device. Microsoft documents several behaviours you should plan for:

• Every hour, the system contacts the user's Authenticator app to collect the GPS location. The first time, the user gets a notification and must open the app and grant location permission. For the next 24 hours, if the user is still accessing the resource and has allowed background running, the location is shared silently once per hour. After 24 hours, the user must open the app and approve a notification again.
• The app performs jailbreak detection each time, using the same logic as the Microsoft Intune MAM SDK. A jailbroken device's location is not valid and the user is not granted access. On Android, the app uses the Google Play Integrity API, and if that is unavailable the request is denied.
• Users who modify their device location get a denial message for GPS-based policies.
• The country code depends on the device platform API. For example, one platform might report US for Puerto Rico while another reports PR.
• Passwordless phone sign-in works with GPS location only if MFA push notifications are also enabled. GPS location does not work when only passwordless authentication methods, such as passkeys, are set.
• A policy with GPS-based named locations in report-only mode still prompts users to share their location, and not sharing may result in a block.

Microsoft's guidance is that the hourly prompts mean GPS should be used only to protect very sensitive apps where this behaviour is acceptable, or where access must be restricted for a specific country or region.

Unknown countries and regions

Some IP addresses cannot be mapped to a country. Select Include unknown countries/regions when the policy that uses this location should also apply to those addresses. For a block policy this closes a gap, and for an exclusion it widens one, so decide deliberately.

Use the location in a Conditional Access policy

In a policy, open the Network condition. Microsoft documents these options:

Require MFA off the corporate network

1. Create a new policy and assign the users, or a pilot group.
2. Under target resources, choose the apps you want to protect.
3. Under Network, include Any network or location and exclude All trusted networks and locations.
4. Under grant, require multifactor authentication.
5. Set the policy to Report-only first.

This follows Microsoft's example of applying a policy to all locations except trusted ones to limit the scope to locations outside the corporate network.

Block a list of countries

1. Create a policy that targets all users, and exclude your emergency access accounts.
2. Under Network, include Selected networks and locations and choose your countries location.
3. Under grant, choose Block access.
4. Start in Report-only and review sign-in results before enforcing.

Microsoft describes a policy that blocks by location as restrictive and says it should be done with care after thorough testing. Use Conditional Access What If and Troubleshooting to check the effect on a sample user before you turn it on.

Proxies, VPNs and the compliant network

When users reach Entra through a cloud-hosted proxy or VPN, the IP address Entra evaluates is the proxy's address. The X-Forwarded-For header, which holds the user's real public IP, is not used because there is no validation that it comes from a trusted source, and trusting it would allow someone to fake an IP address.

Microsoft's guidance has two parts. First, a policy that requires a Microsoft Entra hybrid joined or compliant device can be easier to manage, because keeping an up-to-date list of IP addresses for a cloud-hosted proxy is nearly impossible. Second, Microsoft recommends Global Secure Access with source IP restoration to avoid the address change. Organisations with Global Secure Access also see All Compliant Network locations, which lets a policy check that traffic comes from users and devices complying with your policies.

When the location is evaluated

Policies are evaluated when a user first signs in to a web, mobile or desktop app, and when a modern-authentication app uses a refresh token to get a new access token, which by default happens about once an hour. A change of network is therefore detected within roughly an hour for those apps. Web apps apply policy at initial sign-in and keep it for the session lifetime, so the time between evaluations varies by application.

Retire the legacy MFA trusted IPs setting

The trusted IPs section of multifactor authentication service settings is not recommended. It accepts only IPv4 addresses and is designed for specific scenarios. If it is configured, its entries appear as MFA Trusted IPs in the location list and are included in All trusted networks and locations, so check for it when a policy exclusion seems broader than your named locations.

Recover and automate

Deleted Conditional Access policies and named locations can be restored within the 30-day soft-delete period. Named locations are also available through the Microsoft Graph namedLocation API, which is useful for keeping IP lists in source control. See Entra Backup and Recovery: Restore Conditional Access for the recovery process.

Troubleshooting

Checklist

• Public egress ranges entered in CIDR form and within the 195-location, 2,000-range and mask limits.
• Only networks you control marked as trusted.
• Countries location uses IP-based detection unless GPS prompts are acceptable.
• Break-glass accounts excluded from every block policy.
• New policies tested in report-only mode first.
• Proxy and VPN egress handled with source IP restoration or device-based controls.
• MFA trusted IPs reviewed and removed where possible.

References

• Conditional Access policy: network signals, Microsoft Learn: https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-assignment-network