Skip to main content

🛡️ Microsoft Entra ID Named Locations are not defined🟢⚪

Description​

Open File

Description​

Microsoft Entra ID Conditional Access allows an organization to configure Named locations and configure whether those locations are trusted or untrusted. These settings provide organizations the means to specify Geographical locations for use in conditional access policies, or define actual IP addresses and IP ranges and whether or not those IP addresses and/or ranges are trusted by the organization.

Rationale​

Defining trusted source IP addresses or ranges helps organizations create and enforce Conditional Access policies around those trusted or untrusted IP addresses and ranges. Users authenticating from trusted IP addresses and/or ranges may have less access restrictions or access requirements when compared to users that try to authenticate to Microsoft Entra ID from untrusted locations or untrusted source IP addresses/ranges.

Impact​

When configuring Named locations, the organization can create locations using Geographical location data or by defining source IP addresses or ranges. Configuring Named locations using a Country location does not provide the organization the ability to mark those locations as trusted, and any Conditional Access policy relying on those Countries location setting will not be able to use the All trusted locations setting within the Conditional Access policy. They instead will have to rely on the Select locations setting. This may add additional resource requirements when configuring, and will require thorough organizational testing.

... see more

Remediation​

Open File

Remediation​

From Azure Portal​

  1. In the Azure Portal, navigate to Microsoft Entra ID.
  2. Under Manage, click Security.
  3. Under Protect, click Conditional Access.
  4. Under Manage, click Named locations.
  5. Within the Named locations blade, click on IP ranges location.
  6. Enter a name for this location setting in the Name text box.
  7. Click on the + sign.
  8. Add an IP Address Range in CIDR notation inside the text box that appears.
  9. Click on the Add button.
  10. Repeat steps 7 through 9 for each IP Range that needs to be added.
  11. If the information entered are trusted ranges, select the Mark as trusted location check box.
  12. Once finished, click on Create.

From PowerShell​

Create a new trusted IP-based Named location policy:

[System.Collections.Generic.List`1[Microsoft.Open.MSGraph.Model.IpRange]]$ipRanges = @() $ipRanges.Add("<first IP range in CIDR notation>") $ipRanges.Add("<second IP range in CIDR notation>") $ipRanges.Add("<third IP range in CIDR notation>") New-MgIdentityConditionalAccessNamedLocation -dataType "#microsoft.graph.ipNamedLocation" -DisplayName "<name of IP Named location policy>" -IsTrusted $true -IpRanges $ipRanges

... [see more](remediation.md)

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 CIS Azure v2.1.0 → 💼 1.2.1 Ensure Trusted Locations Are Defined - Level 1 (Manual)1no data
💼 CIS Azure v3.0.0 → 💼 2.2.1 Ensure Trusted Locations Are Defined (Manual)1no data
💼 CIS Azure v4.0.0 → 💼 6.2.1 Ensure that 'trusted locations' are defined (Manual)1no data
💼 Cloudaware Framework → 💼 General Access Controls11no data