Named locations and country blocking: useful, but never enough
Blocking sign-ins from countries where you have no business is often one of the first Conditional Access policies deployed. It is a reasonable measure, provided you understand what it stops and what it lets through.
Two kinds of named location
Entra ID lets you define locations by IP address ranges (IPv4 and IPv6, in CIDR notation) or by countries and regions. In the latter case, the country is determined from the IP address or, optionally, from GPS coordinates provided by Microsoft Authenticator. An IP range can be marked as trusted, which notably influences risk evaluation in Identity Protection.
What country blocking gives you
It removes some of the noise: automated password spray from foreign infrastructure, opportunistic attempts, sign-ins from networks the organisation has no reason to see. It reduces the exposed surface and makes logs easier to read. It is a useful and inexpensive layer.
Its limits
- VPNs and proxies: an attacker can freely choose the country their traffic exits from. Modern phishing kits often relay the sign-in through infrastructure close to the victim.
- Imperfect geolocation: IP-to-country databases contain errors, especially for mobile operators and cloud services.
- IPv6: if your trusted ranges only cover IPv4 while your internet egress uses IPv6, your policies will not behave as intended.
- Travelling users: every business trip generates exception requests, often granted permanently and never removed.
Golden rule. A "trusted" location must never exempt users from MFA. An account whose password is known and which signs in from the corporate network, or through a compromised machine on that network, is still a compromised account.
Handling exceptions properly
For travel, use a dedicated exception group, populated on request with an end date, rather than excluding individual users directly in the policy. Access reviews, or eligible membership through PIM for Groups, stop those exceptions from becoming permanent. Also consider the "include unknown countries/regions" option: an address that cannot be geolocated is not legitimate by default.
Legacy settings not to forget
The legacy MFA service settings contain a list of trusted IP addresses that can bypass MFA. It is often forgotten during the move to Conditional Access. Make sure that list is empty, or strictly justified.
What an audit checks
- Policies that grant access without MFA based on location.
- IP ranges marked as trusted and whether they are still relevant, IPv6 included.
- User exclusions in geographic policies.
- Trusted IPs in the legacy MFA settings.