How to set up named locations for Conditional Access

What this check looks at

Checks whether trusted named locations exist to support location-aware policy and risk evaluation.

Named locations are lists of IP address ranges or countries defined for Conditional Access. An IP range can be marked as trusted, which tells Microsoft Entra ID that sign-ins from it come from the organisation’s own offices or VPN. A new tenant has no named locations.

This check applies where at least one Conditional Access policy exists and counts the named locations defined. The check fails when there are none.

Without them, Conditional Access cannot treat the office differently from anywhere else, so policies that depend on location cannot be written: blocking countries the organisation never works from, allowing security info registration only from the office, or asking for more outside it. Microsoft Entra ID Protection also uses trusted locations when it scores sign-in risk, so without them more ordinary sign-ins look unusual and real risky ones stand out less.

Why it matters

Without named locations, Conditional Access cannot distinguish the head office from an anonymous proxy, and Identity Protection loses a strong signal when scoring sign-in risk.

A typical case: a 40-person UK firm sees repeated password spraying from overseas against its accounts. With a countries named location it could block sign-ins from outside the UK and the handful of countries staff travel to; without one, every attempt reaches the password check, and one weak password is all it takes.

Location is a signal, not a boundary: addresses can be disguised with VPNs and proxies, and MFA must still apply in the office. As an extra condition, though, it removes a large share of opportunistic attacks and makes policies like protected security info registration practical.

ISO 27001 A.5.15 (access control), the NCSC 10 Steps identity and access management guidance and the NCSC CAF identity and access management outcome expect access rules to take the context of a sign-in into account.

How to fix it

Where: Entra admin centre → Protection → Conditional Access → Named locations

Before you start

• Get the public IP addresses of each office and VPN from the network provider.

Step by step

1. 1Collect the office and VPN addresses. Ask the client or their internet provider for the public (outbound) IP addresses of each office and any VPN or remote access gateway, in CIDR form (for example 203.0.113.10/32). Check them against recent office sign-ins in Entra ID > Monitoring & health > Sign-in logs (IP address column).
2. 2Create a trusted IP ranges location. In the Microsoft Entra admin centre, go to Entra ID > Conditional Access > Named locations and select IP ranges location. Name it (for example "Head office"), tick Mark as trusted location, add each range with the + button and select Create.
3. 3Create a countries location. Select Countries location, name it (for example "Allowed countries"), choose to determine location by IP address, tick United Kingdom and any countries staff regularly work from, and select Create. This can be used later in a policy that blocks sign-ins from everywhere else.
4. 4Or create them with PowerShell. In Microsoft Graph PowerShell (Connect-MgGraph -Scopes Policy.ReadWrite.ConditionalAccess): New-MgIdentityConditionalAccessNamedLocation -BodyParameter @{ "@odata.type" = "#microsoft.graph.ipNamedLocation"; displayName = "Head office"; isTrusted = $true; ipRanges = @(@{ "@odata.type" = "#microsoft.graph.iPv4CidrRange"; cidrAddress = "203.0.113.10/32" }) }.
5. 5Use them in policies, never as the only control. Use the locations as conditions alongside MFA: for example exclude trusted locations from the security info registration policy, or block sign-ins from outside the allowed countries for all users except the emergency access accounts, starting in report-only mode.
6. 6Confirm the locations work. Entra ID > Conditional Access > Named locations should list each office range marked trusted. Sign in from the office and check the sign-in log’s Location details show the named location. The finding clears at the next assessment.

What users will notice

None by itself. Named locations are used by Conditional Access policies.

How to confirm it worked

Entra ID, Conditional Access, Named locations lists each office range, marked trusted.

Frameworks and controls

This check maps to controls in 9 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.

The framework mappings were last checked against the published standards in October 2026.

Microsoft’s documentation

• Named locations (Microsoft Learn)

Related checks

• Microsoft 365 offboarding checklist for leavers
• How to find inactive users in Microsoft 365
• How to check directory synchronisation is still running
• How to add and verify a custom domain in Microsoft 365

The full Microsoft 365 security checklist, worst first