IP based login

Question

Hello everyone,

I have a static IP address provided by the ISP, at my workplace.

I want to restrict only a few users to be able to log in ONLY from the workplace based on if they are connected to the office internet network.

I am trying to configure the conditional access policy but am unable to do it, as it is asking for an IPv4 range and I do not where to get it from.

There is no one else on the team and I am alone in figuring this out.

How can I restrict users from using their ID outside of the workplace?

Thank you,

Vishesh Jain

Answer 1

Hello @Vishesh Jain,

Thank you for posting your query on Microsoft Q&A.

Based on your description, I understand that you're trying to block access to resources when users are outside of your office network, while allowing access from within the office network.

To achieve this, you can create a conditional access policy that blocks access for users outside your office network by excluding your office network's IP ranges. Before creating the conditional access policy, you’ll need to create a named location policy and add your office network’s IP ranges.

Follow these steps:

1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
2. Browse to Protection > Conditional Access > Named locations.
3. Choose the type of location to create >> IP ranges location.
4. Give your location a name.
5. Provide the IP ranges, you can optionally Mark as trusted location.
6. Select Create

Note: You must provide a named location by public IPv4 or IPv6 address ranges. For devices on a private network, the IP address isn't the client IP of the user’s device on the intranet (like 10.55.99.3), it's the address used by the network to connect to the public internet (like 198.51.100.3). Please refer below document for more information.

https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-assignment-network#ipv4-and-ipv6-address-ranges

If you would like to know your public IP address, please do check with your ISP or search for what is my IP on Google Search, you’ll get the IP address of the computer or device where you did the search.

Now follow the below steps to create block conditional access policy:

1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
2. Browse to Protection > Conditional Access > Policies.
3. Select New policy.
4. Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies.
5. Under Assignments, select Users or workload identities.
   1. Under Include, select All users.
   2. Under Exclude, select Users and groups and choose your organization's emergency access or break-glass accounts.
6. Under Target resources > Cloud apps > Include, select All cloud apps.
7. Under Network.
   1. Set Configure to Yes
   2. Under Include, select Any network or location
   3. Under Exclude, Select Selected networks and locations
   4. Select the named location you created for your organization network.
   5. Click Select.
8. Under Access controls > select Block Access and click Select.
9. Confirm your settings and set Enable policy to On.
10. Select Create to create to enable your policy. After administrators confirm the settings using report-only mode, they can move the Enable policy toggle from Report-only to On.

Note: For testing, it's always recommended to apply the policy to a test user first. Once confirmed, you can include additional users as needed.

Caution: Misconfiguring a block policy can lead to organizations being locked out, so be sure to test thoroughly.

For more details, refer to the documentation:

https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-policy-location

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Thanks,
Raja Pothuraju.

Answer 2

You know your IP address, right? Use /32 to get the range. For example, if your IP address is 1.2.3.4, the range you can use is 1.2.3.4/32.