🚦🔴👨💼CA - Block Remote Work for not allowed users
Some roles are office-only by design. This one makes 'office-only' something the tenant enforces, not something HR merely hopes for.
What this policy is about 🧭
A handful of roles are meant to work on-site and nowhere else: the front desk, a shared floor terminal, a till, a role bound to on-prem kit. This policy takes the members of the Not Allowed to Work Remote group and blocks their sign-in from everywhere except your trusted Customer Locations. In from the office network, fine. In from home Wi-Fi, a cafe, or an IP nobody recognises, denied.
It targets one group, not the whole tenant, so it is a scalpel, not a wall. Everyone else keeps working wherever they like.
The grant is Block, but the condition is Locations, and locations lean on IP. If your office egress IP is not correctly captured in the Customer Locations named location, on-site users get blocked and remote attackers with a spoofed nothing get nothing extra: it fails closed. Get the named location right before you enforce, or the first casualty is the reception desk.
Why this matters 🕵️
For a genuinely office-only role, a sign-in from a random home connection is not "someone working late", it is a signal. Either the account is being used somewhere it should not be, or the credentials have wandered. Blocking off-network sign-in for these users turns that grey area into a hard line: the account physically cannot authenticate from outside the perimeter, so a stolen password for the front-desk login is worth a great deal less than it looks.
It is the Neutral Zone made policy. These users have a border, the border is your customer locations, and crossing it without a ship gets you turned back rather than negotiated with. That also cuts noise: the flood of "impossible travel" and unfamiliar-location alerts for accounts that were only ever supposed to live at one address simply stops happening.
🛠️ Configuration
Where: Entra admin center → Protection → Conditional Access → Policies.
| Setting | Value |
|---|---|
| Users, include | 🛡️🧑💼👈🔐🚦Group - Not Allowed to Work Remote Users |
| Users, exclude | None |
| Conditions, client apps | Browser; Mobile app and desktop clients |
| Conditions, locations | Include All; exclude 📍🟢NLOC - Customer Locations |
| Target resources | All cloud apps |
| Grant | Block access |
| Session | None |
The logic reads cleanly: the policy fires for included users on any location that is not a Customer Location, and where it fires it blocks. Include All, exclude the trusted set, block the remainder. Because the include is a single group rather than All users, no break-glass exclusion is needed here: your emergency accounts are not office-only staff.
Roll it out in Report-only first and watch the would-be blocks. On-site users showing up as blocked mean the office IP is missing from the named location; fix that before you flip to On, or day one is a helpdesk queue with a view of the car park.
Caveats ⚠️
Locations are only as honest as their IPs. This whole control rests on Customer Locations holding every trusted egress: each office, VPN concentrator, branch, and failover WAN. Miss one and legitimate users are locked out; capture a shared or dynamic public IP that is not really yours and the perimeter leaks. Re-verify the named location after any WAN, ISP, or VPN change.
Keep the group tight and current. The block is exactly as correct as the membership. A leaver still in the group is harmless; a mover who now needs remote access and is still in it is a support ticket. Review joiners, movers, and leavers on the same cadence you review the roles themselves.
IP location is not device trust. This says where, not what. It does nothing about the health of the machine doing the signing in, so pair it with your device-compliance and MFA policies rather than treating a trusted IP as a clean bill of health.
License and reversibility. Conditional Access and named locations are Entra ID P1, included in Business Premium, no P2 needed for location logic. Clean-revert: set it to Off and these users can sign in from anywhere again, which is exactly why a disabled office-only block belongs in drift detection.
🔗 Related
- 🛡️🧑💼👈🔐🚦Group - Not Allowed to Work Remote Users: the single group this policy acts on; the block is only as good as its membership.
- 📍🟢NLOC - Customer Locations: the trusted-IP named location that defines "the office" for this rule.
- 🚦🟢👨💼CA - MFA for All Users: the identity floor that still applies to everyone this policy does not pin to a desk.
Office-only is a promise until the tenant enforces it. Draw the border at your customer locations, and the promise keeps itself. 🧭