Skip to content

Commit fb6b665

Browse files
authored
Update location-condition.md
1 parent f35a764 commit fb6b665

File tree

1 file changed

+14
-43
lines changed

1 file changed

+14
-43
lines changed

articles/active-directory/conditional-access/location-condition.md

Lines changed: 14 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -30,39 +30,37 @@ Organizations can use this network location for common tasks like:
3030

3131
The network location is determined by the public IP address a client provides to Azure Active Directory. Conditional Access policies by default apply to all IPv4 and IPv6 addresses.
3232

33-
> [!TIP]
34-
> IPv6 ranges are only supported in the **[Named location (preview)](#preview-features)** interface.
35-
3633
## Named locations
3734

38-
Locations are designated in the Azure portal under **Azure Active Directory** > **Security** > **Conditional Access** > **Named locations**. These named network locations may include locations like an organization's headquarters network ranges, VPN network ranges, or ranges that you wish to block.
35+
Locations are designated in the Azure portal under **Azure Active Directory** > **Security** > **Conditional Access** > **Named locations**. These named network locations may include locations like an organization's headquarters network ranges, VPN network ranges, or ranges that you wish to block. Named locations can be defined by IPv4/IPv6 address ranges or by countries/regions.
3936

4037
![Named locations in the Azure portal](./media/location-condition/new-named-location.png)
4138

42-
To configure a location, you will need to provide at least a **Name** and the IP range.
43-
44-
The number of named locations you can configure is constrained by the size of the related object in Azure AD. You can configure locations based on of the following limitations:
39+
### IP address ranges
4540

46-
- One named location with up to 1200 IPv4 ranges.
47-
- A maximum of 90 named locations with one IP range assigned to each of them.
41+
To define a named location by IPv4/IPv6 address ranges, you will need to provide a **Name** and an IP range.
4842

49-
> [!TIP]
50-
> IPv6 ranges are only supported in the **[Named location (preview)](#preview-features)** interface.
43+
Named locations defined by IPv4/IPv6 address ranges are subject to the following limitations:
44+
- Configure up to 195 named locations
45+
- Configure up to 2000 IP ranges per named location
46+
- Both IPv4 and IPv6 ranges are supported
47+
- Private IP ranges connot be configured
48+
- The number of IP addresses contained in a range is limited. Only CIDR masks greater than /8 are allowed when defining an IP range.
5149

5250
### Trusted locations
5351

54-
When creating a network location, an administrator has the option to mark a location as a trusted location.
52+
Administrators can designate named locations defined by IP address ranges to be trusted named locations.
5553

5654
![Trusted locations in the Azure portal](./media/location-condition/new-trusted-location.png)
5755

58-
This option can factor in to Conditional Access policies where you may, for example, require registration for multi-factor authentication from a trusted network location. It also factors in to Azure AD Identity Protection's risk calculation, lowering a users' sign-in risk when coming from a location marked as trusted.
56+
Sign-ins from trusted named locations improve the accuracy of Azure AD Identity Protection's risk calculation, lowering a users' sign-in risk when they authenticate from a location marked as trusted. Additionally, trusted named locations can be targeted in Conditional Access policies. For example, you may require restrict multi-factor authentication registration to trusted named locations only.
5957

6058
### Countries and regions
6159

62-
Some organizations may choose to define entire countries or regions IP boundaries as named locations for Conditional Access policies. They may use these locations when blocking unnecessary traffic when they know valid users will never come from a location such as North Korea. These mappings of IP address to country are updated periodically.
60+
Some organizations may choose to restrict access to certain countries or regions using Conditional Access. In addition to defining named locations by IP ranges, admins can define named locations by country or regions. When a user signs in, Azure AD resolves the user's IPv4 address to a country or region, and the mapping is updated periodically. Organizations can use named locations defined by countries to block traffic from countries where they do not do business, such as North Korea.
6361

6462
> [!NOTE]
65-
> IPv6 address ranges cannot be mapped to countries. Only IPv4 addresses map to countries.
63+
> Sign-ins from IPv6 addresses cannot be mapped to countries or regions, and are considered unknown areas. Only IPv4 addresses can be mapped to countries or regions.
6664
6765
![Create a new country or region-based location in the Azure portal](./media/location-condition/new-named-location-country-region.png)
6866

@@ -89,33 +87,6 @@ For mobile and desktop applications, which have long lived session lifetimes, Co
8987

9088
If both steps fail, a user is considered to be no longer on a trusted IP.
9189

92-
## Preview features
93-
94-
In addition to the generally available named location feature, there is also a named location (preview). You can access the named location preview by using the banner at the top of the current named location blade.
95-
96-
![Try the named locations preview](./media/location-condition/preview-features.png)
97-
98-
With the named location preview, you are able to
99-
100-
- Configure up to 195 named locations
101-
- Configure up to 2000 IP Ranges per named location
102-
- Configure IPv6 addresses alongside IPv4 addresses
103-
104-
We’ve also added some additional checks to help reduce the change of misconfiguration.
105-
106-
- Private IP ranges can no longer be configured
107-
- The number of IP addresses that can be included in a range are limited. Only CIDR masks greater than /8 will be allowed when configuring an IP range.
108-
109-
With the preview, there are now two create options:
110-
111-
- **Countries location**
112-
- **IP ranges location**
113-
114-
> [!NOTE]
115-
> IPv6 address ranges cannot be mapped to countries. Only IPv4 addresses map to countries.
116-
117-
![Named locations preview interface](./media/location-condition/named-location-preview.png)
118-
11990
## Location condition in policy
12091

12192
When you configure the location condition, you have the option to distinguish between:
@@ -141,7 +112,7 @@ With this option, you can select one or more named locations. For a policy with
141112

142113
## IPv6 traffic
143114

144-
By default, Conditional Access policies will apply to all IPv6 traffic. With the [named location preview](#preview-features), you can exclude specific IPv6 address ranges from a Conditional Access policy. This option is useful in cases where you don’t want policy to be enforced for specific IPv6 ranges. For example, if you want to not enforce a policy for uses on your corporate network, and your corporate network is hosted on public IPv6 ranges.
115+
By default, Conditional Access policies will apply to all IPv6 traffic. You can exclude specific IPv6 address ranges from a Conditional Access policy if you don’t want policies to be enforced for specific IPv6 ranges. For example, if you want to not enforce a policy for uses on your corporate network, and your corporate network is hosted on public IPv6 ranges.
145116

146117
### When will my tenant have IPv6 traffic?
147118

0 commit comments

Comments
 (0)