{
  "id": "CB-M365-AUTH-032",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-032",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-032.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-032.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-032",
    "title": "Define the organization's trusted network locations",
    "finding": {
      "title": "No trusted network locations are defined in Conditional Access",
      "description": "Policies cannot tell corporate egress addresses from the rest of the internet, and ID Protection loses a signal to rate sign-in risk."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "conditional-access",
      "named-locations",
      "network"
    ],
    "applicability": {
      "requires": [
        "Microsoft Entra ID P1"
      ]
    },
    "description": "The public IP ranges used by the organization to reach Microsoft 365 (internet egress of offices,\ndata centers, VPN concentrators, cloud proxy) are declared as **IP ranges** named locations in\nConditional Access and marked as **trusted**. The list is owned by the network team and reviewed\nwhen egress points change.\n",
    "rationale": "Trusted locations reduce false positives in ID Protection (sign-ins from them are rated lower\nrisk) and let administrators write precise policies, for example restricting security info\nregistration or service accounts to the corporate network (CB-M365-AUTH-019). A missing or stale\nlist leads to broad exclusions instead.\n",
    "impact": "None by itself: a named location changes nothing until a policy uses it. Do not use a trusted\nlocation as a reason to skip MFA for everyone; an attacker on the corporate network or on a\ncompromised device inside it would then bypass it.\n",
    "notes": "Only public egress addresses count; private ranges (10.0.0.0/8 and similar) are never seen by\nMicrosoft Entra ID. With a cloud proxy or SSE solution, declare the proxy's egress ranges, or use\nGlobal Secure Access source IP restoration.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Security Reader.\n2. Browse to **Entra ID** > **Conditional Access** > **Named locations**.\n3. Check that at least one **IP ranges** location exists with **Trusted** set to **Yes**, and\n   that its ranges match the current list of corporate egress addresses provided by the network\n   team.\n4. Alternative in PowerShell (Microsoft Graph, scope `Policy.Read.All`):\n   `Get-MgIdentityConditionalAccessNamedLocation | Where-Object { $_.AdditionalProperties.isTrusted } | Select-Object DisplayName, @{n='Ranges';e={$_.AdditionalProperties.ipRanges.cidrAddress}}`\n5. Fail if no trusted IP location exists, or if it contains ranges the organization does not own\n   or no longer uses.\n"
    },
    "remediation": {
      "manual": "1. Get the list of public egress IP ranges from the network team.\n2. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.\n3. Browse to **Entra ID** > **Conditional Access** > **Named locations** > **IP ranges\n   location**.\n4. Enter a name, add each range in CIDR notation, select **Mark as trusted location** and\n   **Create**.\n5. Record the owner of the list and review it at each network change.\n\nIn PowerShell: `New-MgIdentityConditionalAccessNamedLocation` with `@odata.type`\n`#microsoft.graph.ipNamedLocation`, `ipRanges` and `isTrusted = $true`.\n",
      "rollback": "Clear **Mark as trusted location**, or delete the location once no policy references it.\n"
    },
    "references": [
      {
        "title": "Network-based Conditional Access - named locations",
        "url": "https://learn.microsoft.com/entra/identity/conditional-access/concept-assignment-network",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-3",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-033",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-019",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}