Question Regarding Source IP Restrictions for Azure Authentication

Question

Is it possible to configure source IP restrictions during authentication in Azure?

Could you please let us know whether it is possible to restrict the source IP address for authentication in the following scenarios?

Sign-in to the Azure Portal by users managed in Entra ID

Sign-in using a user account from the CLI

Sign-in using a user account from PowerShell

Sign-in using a service principal

Sign-in from the Azure mobile app

Answer 1

Hey there! You can’t natively attach an IP-allow/deny list to the Azure AD authentication endpoint itself the way you do for an App Service, but you can achieve IP-based sign-in restrictions for most Azure login scenarios by using Microsoft Entra ID Conditional Access with Named Locations. Here’s how it breaks down:

1. Sign-in to the Azure portal (Entra ID users)
   • Use a Conditional Access policy with the “Location” condition scoped to one or more Named Locations (your trusted IP ranges).
   • Grant access only if the sign-in comes from those IP ranges.
   • Any portal login from outside those ranges will be blocked.
2. Sign-in via Azure CLI or Azure PowerShell
   • Both tools leverage the same modern-auth (MSAL) pipeline under the covers, so they honor Conditional Access policies too.
   • If you target users with a location-based policy, CLI/PowerShell logins from disallowed IPs will be refused.
3. Sign-in from the Azure mobile app
   • The mobile app also uses modern auth and is subject to the same Conditional Access “Location” rules.
   • You can block mobile sign-ins outside your corporate IP ranges.
4. Sign-in with a service principal (client-credential flow)
   • Conditional Access policies apply only to user-interactive/OAuth flows. Non-interactive client-credential grants (pure service principal logins) aren’t evaluated by Conditional Access location rules.
   • To constrain service principals, you must instead lock down the target resource (for example, Storage account or Key Vault firewall rules, App Service access restrictions, Private Endpoint).

In short:

• For all user logins (portal, CLI, PowerShell, mobile), create a Conditional Access policy that only allows sign-ins from your approved IP ranges (Named Locations).
• For non-interactive service principal logins, enforce network restrictions at the resource layer.

Please let us know the above steps help

References

1. Conditional Access “Named locations” (IP-based sign-in controls): https://learn.microsoft.com/azure/active-directory/conditional-access/concept-named-locations
2. Conditional Access overview: https://learn.microsoft.com/azure/active-directory/conditional-access/overview
3. Restrict access to a tenant (tenant restrictions): https://learn.microsoft.com/entra/identity/enterprise-apps/tenant-restrictions
4. Source IP Restoration (viewing true client IP in sign-in logs): https://learn.microsoft.com/entra/global-secure-access/how-to-source-ip-restoration
5. Microsoft Entra auth operations guide (Conditional Access location condition): https://learn.microsoft.com/entra/architecture/ops-guide-auth#access-surface-area