Description:
Ensure trusted locations are defined in Microsoft Entra ID Conditional Access policies to identify known and secure network locations, such as corporate public IP ranges. Trusted locations enable Conditional Access to distinguish between trusted and untrusted sign-in attempts, improving access control decisions and strengthening identity protection.
Rationale:
Without defined trusted locations, Conditional Access policies cannot reliably distinguish between trusted and untrusted sign-in sources, increasing the risk of unauthorized access and credential-based attacks. Defining trusted locations improves risk evaluation, strengthens access control decisions, and supports a Zero Trust security posture.
Impact:
Defining trusted locations improves the accuracy of risk-based Conditional Access decisions, reduces the risk of unauthorized access from unknown networks, enables effective enforcement of trusted versus untrusted access policies, strengthens Zero Trust and identity governance strategies, and supports compliance requirements related to identity security.
Default Value:
By default, Microsoft Entra ID does not have any trusted locations configured.
Pre-Requisites:
Documented corporate public IP address ranges
Microsoft Entra ID P1 or P2 license for Conditional Access
Test Plan:
Sign in to the Azure Portal at https://portal.azure.com
Search for Microsoft Entra ID and open it
Under the Manage section, select Security
Under the Manage section, open Named locations
Verify that at least one trusted location is defined with corporate public IP address ranges
If trusted locations are not defined, follow the implementation steps
Implementation Steps:
Sign in to the Azure Portal at https://portal.azure.com
Search for Microsoft Entra ID and open it
Under the manage section, Select Security
Under the manage section, Open Named locations.
Select New location
Enter a name for the trusted location
Select the IP ranges location
Add the corporate public IP address ranges
Mark the location as trusted
Save the configuration
Backout Plan:
Sign in to the Azure Portal at https://portal.azure.com
Search for Microsoft Entra ID and open it
Under the Manage section, select Security
Under the Manage section, open Named locations
Select the trusted location created or modified
Delete the trusted location or remove the added IP address ranges
Save the changes
Reference:
https://learn.microsoft.com/entra/identity/conditional-access/concept-named-locations
https://learn.microsoft.com/entra/identity/conditional-access/overview
https://learn.microsoft.com/entra/identity/conditional-access/location-condition


