Back to Checks
azure

Entra tenant has a trusted named location with IP ranges defined

entra_trusted_named_locations_exists
Service: entraSeverity: low
OfficialBuilt-inVerified
Categories:identity-accesstrust-boundariese3
Resource Type:NotDefined

Microsoft Entra ID Conditional Access supports trusted named locations defined by public IP ranges. Presence of at least one location marked trusted with IP CIDR ranges available for use in policy conditions.

Prowler logoProwlerprowler-provider-azure

Risk

Without trusted IP-based locations, policies can't reliably distinguish corporate networks from unknown sources. This weakens confidentiality and integrity, enabling risky sign-ins to avoid stricter controls and forcing coarse rules that over-prompt users or leave account takeover and data exfiltration paths open.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks entra_trusted_named_locations_exists

Recommendation

Define named locations for your organization's egress IP ranges and mark them as trusted. Keep ranges accurate and narrow; review regularly. Use them in Conditional Access to enforce stronger controls off trusted networks. Apply zero trust and least privilege, and require MFA or device compliance when outside trusted locations.

Remediation

CLI

az rest --method post --url https://graph.microsoft.com/v1.0/identity/conditionalAccess/namedLocations --headers Content-Type=application/json --body '{"@odata.type":"#microsoft.graph.ipNamedLocation","displayName":"<example_resource_name>","isTrusted":true,"ipRanges":[{"@odata.type":"#microsoft.graph.iPv4CidrRange","cidrAddress":"203.0.113.0/24"}]}'

Terraform

resource "azuread_named_location" "<example_resource_name>" {
  display_name = "<example_resource_name>"

  ip {
    ip_ranges = ["203.0.113.0/24"]
    trusted   = true # Critical: marks the location as trusted for Conditional Access policies
  }
}

Other

1Sign in to the Microsoft Entra admin center (entra.microsoft.com)
2Go to Microsoft Entra ID > Protection > Conditional Access > Named locations
3Click New location
4Enter Name: <example_resource_name>
5Choose IP ranges location and add an IP range (e.g., 203.0.113.0/24)
6Check Mark as trusted location
7Click Create

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.entra.entra_client import entra_client


class entra_trusted_named_locations_exists(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        tenant_id = entra_client.tenant_ids[0]

        for tenant_domain, named_locations in entra_client.named_locations.items():
            trusted_location_found = False
            for named_location in named_locations.values():
                if named_location.ip_ranges_addresses and named_location.is_trusted:
                    report = Check_Report_Azure(
                        metadata=self.metadata(), resource=named_location
                    )
                    report.subscription = f"Tenant: {tenant_domain}"
                    report.status = "PASS"
                    report.status_extended = f"Trusted location {named_location.name} exists with trusted IP ranges: {[ip_range for ip_range in named_location.ip_ranges_addresses if ip_range]}"
                    findings.append(report)
                    trusted_location_found = True

            if not trusted_location_found:
                report = Check_Report_Azure(metadata=self.metadata(), resource={})
                report.status = "FAIL"
                report.subscription = f"Tenant: {tenant_domain}"
                report.resource_name = tenant_domain
                report.resource_id = tenant_id
                report.status_extended = (
                    "There is no trusted location with IP ranges defined."
                )
                findings.append(report)

        return findings

References