Detections
Analytics

5.2.2.14 Ensure trusted 'named locations' are defined

Information

Microsoft Entra ID Conditional Access allows an organization to configure Named locations and configure whether those locations are trusted or untrusted. These settings provide organizations the means to specify Geographical locations for use in conditional access policies, or define actual IP addresses and IP ranges and whether or not those IP addresses and/or ranges are trusted by the organization.

The recommended state is to define at least one trusted, IP range named location.

Defining trusted source IP addresses or ranges enables organizations to better tailor and enforce Conditional Access policies based on whether authentication attempts originate from trusted or untrusted network locations. Users signing in from trusted IP ranges can be granted reduced access requirements or fewer authentication prompts, while users coming from untrusted or unknown locations may face stricter controls.

Additionally, marking named locations as trusted improves the accuracy of Microsoft Entra ID Protection's risk evaluations. When a user authenticates from a trusted location, their sign-in risk is appropriately lowered, helping reduce false positives and ensuring that risk-based policies trigger only when truly necessary.

Solution

To remediate using the UI:

 - Navigate to the Microsoft Entra admin center https://entra.microsoft.com.
 - Expand Entra ID > Conditional Access and select Policies.
 - Under Manage, click Named locations.
 - Click on IP ranges location to add a new location.
 - Enter a name for this location setting in the Name field.
 - Click on the + icon.
 - Add only a trusted IP Address Range in CIDR notation inside the text box that appears.
 - Click on the Add button.
 - Repeat steps 6 through 8 for each additional IP range.
 - Select the Mark as trusted location checkbox.
 - Once finished, click on Create.

Note: There is no single prescribed method for applying a named location to a Conditional Access policy, as the correct configuration depends on the specific access control requirements. Implementers should have a clear understanding of how named locations function before applying them to production policies.

Impact:

Configuring named locations by country cannot designate those locations as trusted, which means Conditional Access policies cannot use the "All trusted locations" option and must instead rely on explicitly selecting locations. This increases the administrative effort needed to configure and maintain these policies and requires more thorough testing to prevent unintended authentication blocks. Because Conditional Access policies can fully prevent users from signing in to Entra ID if misconfigured, organizations should maintain a dedicated break-glass Global Administrator account that is excluded from all Conditional Access policies and secured with a strong passphrase and hardware-based authentication. This account exists solely to recover access if all other administrators are locked out.

See Also

https://workbench.cisecurity.org/benchmarks/24620

Item Details

Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|AC-2(1), 800-53|AC-3, 800-53|AC-17, 800-53|AC-17(1), 800-53|CM-7, 800-53|CP-6, 800-53|CP-7, 800-53|PL-8, 800-53|PM-7, 800-53|SA-8, 800-53|SC-7, 800-53|SI-4

Plugin: microsoft_azure

Control ID: 0fb99ce0ca024db5d9ee572092bcf83da9995553fbb3b177dc414855a395ef8b