Skip to content

Commit 91b2951

Browse files
Merge pull request #247260 from MicrosoftGuyJFlo/GitHubIssue113139
[Microsoft Entra ID] GitHub Issue 113139
2 parents f712661 + d983378 commit 91b2951

File tree

1 file changed

+1
-4
lines changed

1 file changed

+1
-4
lines changed

articles/active-directory/conditional-access/concept-continuous-access-evaluation-strict-enforcement.md

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,6 @@ Strictly enforce location policies is a new enforcement mode for continuous acce
2424
| Standard (Default) | Suitable for all topologies | A short-lived token is issued only if Azure AD detects an allowed IP address. Otherwise, access is blocked | Falls back to the pre-CAE location detection mode in split tunnel network deployments where CAE enforcement would affect productivity. CAE still enforces other events and policies. | None (Default Setting) |
2525
| Strictly enforced location policies | Egress IP addresses are dedicated and enumerable for both Azure AD and all resource provider traffic | Access blocked | Most secure, but requires well understood network paths | 1. Test IP address assumptions with a small population <br><br> 2. Enable “Strictly enforce” under Session controls |
2626

27-
> [!NOTE]
28-
> The **IP address (seen by resource)** is blank when that IP matches the IP address.
29-
3027
## Configure strictly enforced location policies
3128

3229
### Step 1 - Configure a Conditional Access location based policy for your target users
@@ -77,7 +74,7 @@ Administrators can investigate the Sign-in logs to find cases with **IP address
7774
1. Sign in to the **Azure portal** as at least a Global Reader.
7875
1. Browse to **Azure Active Directory** > **Sign-ins**.
7976
1. Find events to review by adding filters and columns to filter out unnecessary information.
80-
1. Add the **IP address (seen by resource)** column and filter out any blank items to narrow the scope.
77+
1. Add the **IP address (seen by resource)** column and filter out any blank items to narrow the scope. The **IP address (seen by resource)** is blank when that IP seen by Azure AD matches the IP address seen by the resource.
8178

8279
[ ![Screenshot showing an example of how to find more information in the sign-in logs.](./media/concept-continuous-access-evaluation-strict-enforcement/sign-in-logs-ip-address-seen-by-resource.png) ](./media/concept-continuous-access-evaluation-strict-enforcement/sign-in-logs-ip-address-seen-by-resource.png#lightbox)
8380

0 commit comments

Comments
 (0)