“Can we just block every country except ours?” It is one of the most common requests I get, and it is a fair question. Conditional Access named locations make country blocking easy to set up, and it does remove a lot of noise. But it is also one of the controls most likely to give a business owner a sense of safety it hasn’t earned.
This article explains what named locations are, what country blocking really stops, where it falls down, and how to use location in Conditional Access as a useful layer rather than a substitute for strong authentication.
What named locations are
Named locations live in Entra ID > Conditional Access > Named locations and need Microsoft Entra ID P1 (included in Microsoft 365 Business Premium, E3 and E5). There are two kinds:
IP ranges locations: public IPv4 or IPv6 ranges in CIDR notation, such as your office internet connection or VPN egress. These can be marked as trusted.
Countries locations: one or more countries or regions, determined by the sign-in’s IP address or, optionally, by GPS coordinates from Microsoft Authenticator. You can choose to include unknown countries and regions, which covers IP addresses that can’t be mapped.
A few practical limits worth knowing: no more than 195 IP-based named locations, no more than 2,000 IP ranges per location, and CIDR masks must be larger than /8. Remember that Entra ID sees the public IP your network uses to reach the internet, not the private address of the laptop.
What country blocking actually stops
A policy that blocks sign-ins from outside the countries you operate in is genuinely useful for:
Cutting noise. A large share of opportunistic password spraying comes from infrastructure abroad. Blocking it means fewer successful-password-but-blocked events to look at.
Limiting damage from a leaked password. If an attacker abroad has a valid password and MFA is somehow bypassed, the location block is one more wall.
Compliance expectations. Some clients and contracts expect data to be accessed only from approved jurisdictions. Location policies help you show that intent.
Where it gives false comfort
Here is the part that matters. Country blocking is weak against a determined attacker, for several reasons:
VPNs and cloud servers. Renting a server or VPN exit in your country costs a few dollars. The phishing kits that steal session tokens increasingly route through local infrastructure precisely to defeat location rules.
Conditional Access runs after the first factor. A blocked foreign sign-in still tells the attacker the password was correct. Country blocking doesn’t stop password spraying from testing passwords, only from using them.
Token theft ignores it at first. If an attacker steals a session token from a user in your country, the token was issued to a local IP. Continuous access evaluation can catch an IP change, but only for IP-based named locations, not country-based ones.
Your own people travel. Every trip abroad becomes an exception request, and exceptions pile up into permanent holes.
IP geolocation isn’t perfect. Mobile carriers and some ISPs map to unexpected countries, which leads to confusing blocks for legitimate users.
The pattern I want to steer people away from is “we block foreign countries, so we skip MFA in the office” or “so we don’t need phishing-resistant MFA”. Location should add to strong authentication, never replace it.
Users: All users. Exclude emergency access accounts and a CA010-Exclude-Travel group.
Target resources: All resources.
Network: Configure Yes. Include Any network or location. Exclude the Allowed-Countries location.
Grant: Block access.
Report-only for at least a week. Check the Report-only tab in sign-in logs for real users who would have been blocked.
Turn on, and set up a simple travel request process that adds a user to the travel group with an end date.
Note that marking your office IP ranges as trusted also improves Microsoft Entra ID Protection’s risk calculation, which reduces false positives for people signing in from the office. That is a good reason to define them even if you never use them to relax a control.
What about GPS-based locations?
Country locations can use GPS from Microsoft Authenticator instead of IP. It is harder to fake than an IP address, and Authenticator rejects locations it detects have been altered. The cost is user friction: people can be prompted every hour to share location, it needs push notifications enabled, and it doesn’t work when users sign in with passwordless methods only. Microsoft suggests keeping it for very sensitive apps. I agree.
What to do instead of relying on location
If you are adding a country block, make sure these are in place first. They do far more of the heavy lifting:
MFA for every user, and phishing-resistant MFA for admins. See our MFA enablement service.
Legacy authentication blocked.
Compliant or managed devices required for Microsoft 365 access, through Intune.
Sign-in risk and user risk policies if you have Entra ID P2.
Monitoring for impossible travel and anonymous IP alerts, which our managed security service handles.
Travel exceptions are where most country block policies quietly fall apart. Someone goes abroad, gets added to an exclusion group, and is still in it two years later. A simple process keeps this under control:
Staff request travel access through a short form or ticket at least two working days before they leave, listing the countries and dates.
IT adds them to the travel exclusion group and sets a calendar reminder for the return date. If you have Entra ID Governance, an access package with an expiry date does this automatically.
While they are away, their sign-ins still need MFA and a compliant device. The exclusion only lifts the country block, nothing else.
On the return date, IT removes them from the group. A monthly check of the group catches anything missed.
An alternative some businesses prefer is a separate policy for travellers that allows a short list of extra countries rather than lifting the block entirely. Either way, keep exceptions time-bound and visible. If the travel group always has half the company in it, the country block isn’t really doing anything.
Frequently asked questions
Should we skip MFA when users are in the office?
I don’t recommend it. An office network exclusion means any compromised or unmanaged device on that network gets a free pass, and modern MFA with passkeys or Windows Hello is nearly invisible to users anyway. Use the trusted location for risk scoring, not for removing MFA.
Does country blocking stop password spray attacks?
Not fully. Conditional Access applies after the password is checked, so attackers can still learn whether a password works. It stops them using the password from a blocked country, which is valuable, but strong MFA is what actually protects the account.
What is the old “MFA trusted IPs” setting?
It is a legacy setting in the multifactor authentication service settings that accepts only IPv4 ranges. Microsoft doesn’t recommend it. Define IP-based named locations in Conditional Access instead and remove the old trusted IPs.
Wondering whether your location rules are helping or just hiding gaps? Book a free Microsoft 365 security assessment and we’ll review your named locations, exclusions and the controls that really protect your accounts.
“Can we just block every country except ours?” It is one of the most common requests I get, and it is a fair question. Conditional Access named locations make country blocking easy to set up, and it does remove a lot of noise. But it is also one of the controls most likely to give a business owner a sense of safety it hasn’t earned.
This article explains what named locations are, what country blocking really stops, where it falls down, and how to use location in Conditional Access as a useful layer rather than a substitute for strong authentication.
What named locations are
Named locations live in
Entra ID > Conditional Access > Named locationsand need Microsoft Entra ID P1 (included in Microsoft 365 Business Premium, E3 and E5). There are two kinds:A few practical limits worth knowing: no more than 195 IP-based named locations, no more than 2,000 IP ranges per location, and CIDR masks must be larger than /8. Remember that Entra ID sees the public IP your network uses to reach the internet, not the private address of the laptop.
What country blocking actually stops
A policy that blocks sign-ins from outside the countries you operate in is genuinely useful for:
Where it gives false comfort
Here is the part that matters. Country blocking is weak against a determined attacker, for several reasons:
The pattern I want to steer people away from is “we block foreign countries, so we skip MFA in the office” or “so we don’t need phishing-resistant MFA”. Location should add to strong authentication, never replace it.
How I set up location policies
Then the country block policy:
CA010-All-AllApps-BlockOutsideAllowedCountries.CA010-Exclude-Travelgroup.Note that marking your office IP ranges as trusted also improves Microsoft Entra ID Protection’s risk calculation, which reduces false positives for people signing in from the office. That is a good reason to define them even if you never use them to relax a control.
What about GPS-based locations?
Country locations can use GPS from Microsoft Authenticator instead of IP. It is harder to fake than an IP address, and Authenticator rejects locations it detects have been altered. The cost is user friction: people can be prompted every hour to share location, it needs push notifications enabled, and it doesn’t work when users sign in with passwordless methods only. Microsoft suggests keeping it for very sensitive apps. I agree.
What to do instead of relying on location
If you are adding a country block, make sure these are in place first. They do far more of the heavy lifting:
Microsoft’s reference on the Conditional Access network assignment covers every location option in detail.
Managing travel without creating permanent holes
Travel exceptions are where most country block policies quietly fall apart. Someone goes abroad, gets added to an exclusion group, and is still in it two years later. A simple process keeps this under control:
An alternative some businesses prefer is a separate policy for travellers that allows a short list of extra countries rather than lifting the block entirely. Either way, keep exceptions time-bound and visible. If the travel group always has half the company in it, the country block isn’t really doing anything.
Frequently asked questions
Should we skip MFA when users are in the office?
I don’t recommend it. An office network exclusion means any compromised or unmanaged device on that network gets a free pass, and modern MFA with passkeys or Windows Hello is nearly invisible to users anyway. Use the trusted location for risk scoring, not for removing MFA.
Does country blocking stop password spray attacks?
Not fully. Conditional Access applies after the password is checked, so attackers can still learn whether a password works. It stops them using the password from a blocked country, which is valuable, but strong MFA is what actually protects the account.
What is the old “MFA trusted IPs” setting?
It is a legacy setting in the multifactor authentication service settings that accepts only IPv4 ranges. Microsoft doesn’t recommend it. Define IP-based named locations in Conditional Access instead and remove the old trusted IPs.
Wondering whether your location rules are helping or just hiding gaps? Book a free Microsoft 365 security assessment and we’ll review your named locations, exclusions and the controls that really protect your accounts.