Back to Checks
m365

A trusted IP-range named location is defined

entra_conditional_access_trusted_named_location_exists
Service: entraSeverity: low
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Conditional Access named locations let an organization define trusted IP ranges that can be referenced by Conditional Access policies. At least one IP-range named location should be marked as Trusted and have at least one IP range defined.

Prowler logoProwlerprowler-provider-m365

Risk

Without a trusted named location, Conditional Access policies cannot differentiate corporate networks from untrusted networks, limiting the ability to build location-aware controls such as blocking access from untrusted locations.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks entra_conditional_access_trusted_named_location_exists

Recommendation

Define at least one trusted IP-range named location representing the organization's corporate networks so it can be referenced by location-aware Conditional Access policies.

Remediation

Other

1Navigate to the Microsoft Entra admin center at https://entra.microsoft.com/
2Go to **Protection** > **Conditional Access** > **Named locations**
3Create a **new IP ranges location**, add the organization's public IP ranges
4Mark the location as **Trusted**
5Click **Create**

Check Code

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.entra.entra_client import entra_client


class entra_conditional_access_trusted_named_location_exists(Check):
    """Check if at least one trusted IP-range named location is defined.

    Conditional Access named locations let an organization define trusted IP ranges.
    At least one IP-range named location should be marked as trusted and have at
    least one IP range defined.

    - PASS: A trusted IP-range named location with at least one IP range exists.
    - FAIL: No trusted IP-range named location with an IP range is defined.
    """

    def execute(self) -> list[CheckReportM365]:
        """Execute the trusted named location check.

        Returns:
            A list containing the trusted named location evaluation report.
        """
        findings = []
        for location in entra_client.named_locations:
            location_name = location.display_name or location.id
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=location,
                resource_name=location.display_name or "Named Location",
                resource_id=location.id,
            )
            report.status = "FAIL"
            report.status_extended = f"Named location '{location_name}' is not a trusted IP-range location with at least one IP range."

            if (
                location.is_ip_location
                and location.is_trusted
                and location.ip_ranges_count >= 1
            ):
                report.status = "PASS"
                report.status_extended = (
                    f"Trusted IP-range named location '{location_name}' "
                    f"is defined with {location.ip_ranges_count} IP range(s)."
                )

            findings.append(report)
        return findings

References