Define the organization's trusted network locations

Description

The public IP ranges used by the organization to reach Microsoft 365 (internet egress of offices, data centers, VPN concentrators, cloud proxy) are declared as IP ranges named locations in Conditional Access and marked as trusted. The list is owned by the network team and reviewed when egress points change.

Only public egress addresses count; private ranges (10.0.0.0/8 and similar) are never seen by Microsoft Entra ID. With a cloud proxy or SSE solution, declare the proxy's egress ranges, or use Global Secure Access source IP restoration.

Rationale

Trusted locations reduce false positives in ID Protection (sign-ins from them are rated lower risk) and let administrators write precise policies, for example restricting security info registration or service accounts to the corporate network (CB-M365-AUTH-019). A missing or stale list leads to broad exclusions instead.

Impact

None by itself: a named location changes nothing until a policy uses it. Do not use a trusted location as a reason to skip MFA for everyone; an attacker on the corporate network or on a compromised device inside it would then bypass it.

Applies when

Requires: Microsoft Entra ID P1

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Security Reader.
2. Browse to Entra ID > Conditional Access > Named locations.
3. Check that at least one IP ranges location exists with Trusted set to Yes, and that its ranges match the current list of corporate egress addresses provided by the network team.
4. Alternative in PowerShell (Microsoft Graph, scope Policy.Read.All): Get-MgIdentityConditionalAccessNamedLocation | Where-Object { $_.AdditionalProperties.isTrusted } | Select-Object DisplayName, @{n='Ranges';e={$_.AdditionalProperties.ipRanges.cidrAddress}}
5. Fail if no trusted IP location exists, or if it contains ranges the organization does not own or no longer uses.

Remediation

1. Get the list of public egress IP ranges from the network team.
2. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
3. Browse to Entra ID > Conditional Access > Named locations > IP ranges location.
4. Enter a name, add each range in CIDR notation, select Mark as trusted location and Create.
5. Record the owner of the list and review it at each network change.

In PowerShell: New-MgIdentityConditionalAccessNamedLocation with @odata.type #microsoft.graph.ipNamedLocation, ipRanges and isTrusted = $true.

Rollback

Clear Mark as trusted location, or delete the location once no policy references it.

References

• Network-based Conditional Access - named locations Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-AUTH-033 Block sign-ins from outside the approved countries
• related CB-M365-AUTH-019 Protect security information registration with a managed device or MFA

People and lifecycle