What this check looks at
Checks for a Conditional Access policy that blocks sign-in from at least one untrusted named location (a country list or an untrusted IP range), for all users and all resources, with trusted locations excluded.
Conditional Access can use where a sign-in comes from. A named location is either a list of countries, worked out from the sign-in’s IP address, or a list of IP ranges, which can be marked as trusted (an office, a VPN). A policy can then block sign-in from the places a business never works from.
This check applies where the tenant has Conditional Access (Entra ID P1). It looks for a policy that targets all users and all resources, includes at least one untrusted named location (a country list, or IP ranges not marked trusted), excludes trusted locations (all of them, or one by name), and blocks access. It passes when such a policy is On and warns when it is only in report-only mode. It fails when there is none, and says it could not check when the named locations were not read.
Without such a policy, a password guessed or phished anywhere in the world can be used from anywhere in the world. MFA still stands in the way, but MFA fatigue, stolen sessions and phishing that relays MFA all come from somewhere, usually far from where the business works.
Why it matters
Most password spraying and stolen-session use comes from countries a business never works from. Blocking sign-in from those places stops a whole class of attack before MFA is even asked, at no cost to people working where the business does.
A 25-person estate agency works only in the UK. Its sign-in log shows hundreds of password attempts a week from other continents against every mailbox. One succeeds against a shared account without MFA, and the attacker sends invoice-fraud emails from it for a day. A policy blocking the countries the agency never works from would have refused every one of those sign-ins before the password was even checked.
Blocking by location is not a replacement for MFA, as attackers can use a VPN in the right country, but it removes most opportunistic attacks cheaply. CIS Microsoft 365 Foundations Benchmark v7.0.0 5.2.2.15 asks for at least one policy blocking untrusted locations, and NIST CSF PR.AA-03 supports it.
How to fix it
Where: Entra admin centre → Entra ID → Conditional Access
Before you start
- List the countries staff, customers’ systems and suppliers sign in from over the last 90 days (sign-in logs, grouped by location), so the block list leaves them out.
- Plan for travel: a group for people abroad, excluded for the length of the trip, is better than a hole in the policy.
- Confirm two emergency access (break-glass) accounts exist and exclude them from the policy, so a mistake cannot lock every administrator out.
- Create the policy in report-only mode first and review its results in Entra ID sign-in logs (Conditional Access tab) for at least a week.
Step by step
- See where sign-ins come from. In the Microsoft Entra admin centre, go to Entra ID > Monitoring & health > Sign-in logs, set the range to the last 90 days and look at the Location column for successful sign-ins. List the countries staff, partners and systems really use.
- Create the named location. Go to Entra ID > Conditional Access > Named locations and select Countries location. Name it "Blocked countries" and tick the countries to block (or, the other way round, every country except those you work from). If you have office IP ranges, add them as an IP ranges location and tick Mark as trusted location.
- Create the policy in report-only mode. Go to Conditional Access > Policies > New policy, name it "Block untrusted locations". Under Users, include All users and exclude your emergency access accounts and a travel exclusion group. Under Target resources choose All resources. Under Network, set Configure to Yes, include Selected networks and locations with "Blocked countries", and exclude All trusted networks and locations. Under Grant choose Block access, set Enable policy to Report-only and select Create.
- Review the report-only results. After a week or two, filter the sign-in logs on the policy’s Report-only result: only sign-ins from the blocked countries should show Report-only: Failure. Remove any country a genuine user signed in from, or add the person to the travel group for their trip.
- Switch the policy on. Open the policy, set Enable policy to On and select Save. The finding clears at the next assessment.
What users will notice
Sign-in from a blocked country is refused, for staff too, unless they are in the travel exclusion group.
How to confirm it worked
The policy state is On, and its report-only or sign-in log results show blocks only from the countries listed.
Frameworks and controls
This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.a Identity verification, authentication and authorisation |
| DSPT | Standard 4: Managing data access |
| NIS2 | Art. 21(2)(j) Multi-factor authentication and secured communications |
| Microsoft Cloud Security Benchmark | IM-7 Restrict resource access based on conditions |
| Zero Trust | IdentitiesNetworks |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.1.1 Limit system access to authorised users, processes and devices |
| CMMC Level 2 | AC.L2-3.1.1 Authorized Access Control |
| ISO 27001:2022 | A.8.5 Secure authenticationA.5.15 Access control |
| CIS M365 | 5.2.2.15 Ensure exclusionary geographic access controls are utilized |
| CIS Controls v8.1 | 6.4 Require MFA for remote network access (IG1) |
| NIST CSF 2.0 | PR.AA-03: Users, services, and hardware are authenticated |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Block access by location with Conditional Access (Microsoft Learn)