How to Configure Named Locations in Entra ID
Named Locations in Entra ID let you define trusted IP ranges and countries that Conditional Access policies can use to require more or less authentication. Configuring named locations is a core part of any zero trust setup.
IP vs country locations
- IP ranges - define trusted networks by CIDR ranges. Typically office static IPs and VPN egress IPs.
- Countries - define locations by country. Useful for blocking sign-ins from countries you do not operate in.
Create an IP-based named location
Create a country-based location
Use in Conditional Access
Named locations appear in CA policy conditions under Locations. Common patterns:
- Require MFA outside trusted IPs - All apps, All users, Location = Not trusted locations, Grant = Require MFA
- Block sign-ins from specific countries - All apps, All users, Location = selected country location, Block access
Frequently Asked Questions
A named location is a defined set of IP addresses or countries that Conditional Access policies can reference in their conditions.
Yes. Create a Countries named location with the countries you want to block, then create a CA policy targeting that location with Block access as the grant control.
Named locations apply to all authentication flows through Entra ID. However, blocking legacy authentication entirely via a separate CA policy is recommended regardless.