📍🟢NLOC - Customer Locations
Home turf, in one label. The customer's known public IPs, marked trusted, so a policy can tell the office from the outside world.
What this location is about 🏰
This is the castle: the set of public IP ranges the customer actually signs in from, the office breakout, the SD-WAN egress, the corporate VPN exit. Gathered into one trusted Named Location, it gives every location-aware policy a single, honest answer to "is this person on home turf?".
It is per-customer by definition. Where the country lists are broadly the same across tenants, this one is filled with a specific business's real IPs, which is exactly why it has to be maintained deliberately and never guessed.
Marking a range trusted tells Entra to relax around it. That is powerful and unforgiving: a stale or wrong IP here can either lock the office out or, worse, extend "home turf" to somebody else on the same shared address. Only genuinely controlled egress IPs belong in this list.
Why this matters 🕵️
Some policies only make sense against a definition of home. "Block these roles from working remotely" needs to know where remote is not, and that is this location, inverted. Without a reliable trusted-IP anchor, location-based rules are guesswork.
The maintenance angle is the real one for an MSP. Offices move, ISPs re-address, a new site opens, a VPN egress changes. Every one of those silently breaks a location policy if this list is not kept current. Treat it as living infrastructure, not a set-and-forget entry, because the day it goes stale is the day either the office cannot log in or an outsider looks like they can.
🛠️ Configuration
Where: Entra admin center → Protection → Conditional Access → Named locations → IP ranges location.
- Create an IP ranges location and add the customer's confirmed public egress ranges (IPv4 and IPv6 as applicable). Confirmed, not assumed, get them from the network owner.
- Tick Mark as trusted location. That flag is the whole point of this one.
- Keep it to genuinely controlled egress. A coffee-shop or home broadband IP is not home turf and must not be in here.
- Review it whenever the customer's connectivity changes, and on a schedule regardless.
Caveats ⚠️
Trusted IP is not identity. Anyone behind the same egress inherits the trust, so this relaxes controls, it does not prove who someone is. Never let a trusted location remove MFA entirely; pair location with the identity and device layers, never as a replacement for them.
Shared and dynamic IPs are traps. A residential or small-office IP that changes, or a carrier-grade NAT shared with strangers, does not belong here. Only static, owned egress earns the trusted flag.
It is the anchor several policies swing on. Because rules reference it by inversion (everything that is not here), an error propagates. A wrong range added here can loosen or break multiple policies at once, so change it carefully and confirm in Report-only where a consuming policy allows.
License and reversibility. Named Locations are Entra ID P1, included in Business Premium. Clean-revert, and given how much rests on it, a changed trusted-IP list is a high-priority item for drift detection.
🔗 Related
- 🚦🔴👨💼CA - Block Remote Work for not allowed users: the office-only policy that treats everything outside this location as remote.
- 📍🟢NLOC - Panic Room: the far stricter trusted location reserved for break-glass accounts.
A trusted location is a promise about the network, so only make it for the network you actually control. Get the castle walls right and the location policies mind themselves. 🏰