Check ID: entra_trusted_named_locations_exists
Provider: Azure
Service: entra
Severity: LOW
Categories: identity-access, trust-boundaries, e3
Resource type: NotDefined

​
What this check verifies

Microsoft Entra ID Conditional Access supports trusted named locations defined by public IP ranges. Presence of at least one location marked trusted with IP CIDR ranges available for use in policy conditions.

​
Risk

Without trusted IP-based locations, policies can’t reliably distinguish corporate networks from unknown sources. This weakens confidentiality and integrity, enabling risky sign-ins to avoid stricter controls and forcing coarse rules that over-prompt users or leave account takeover and data exfiltration paths open.

​
Recommendation

Define named locations for your organization’s egress IP ranges and mark them as trusted. Keep ranges accurate and narrow; review regularly. Use them in Conditional Access to enforce stronger controls off trusted networks. Apply zero trust and least privilege, and require MFA or device compliance when outside trusted locations.

​
Remediation

az rest --method post --url https://graph.microsoft.com/v1.0/identity/conditionalAccess/namedLocations --headers Content-Type=application/json --body '{"@odata.type":"#microsoft.graph.ipNamedLocation","displayName":"<example_resource_name>","isTrusted":true,"ipRanges":[{"@odata.type":"#microsoft.graph.iPv4CidrRange","cidrAddress":"203.0.113.0/24"}]}'

​
References

​
Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_trusted_named_locations_exists. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks