Question

Contoso must block all access to Microsoft 365 from any country except the United States and Canada. Users report that some access attempts from within the US are still being blocked because their IP addresses resolve to unexpected countries through corporate VPN providers. You need to implement a Conditional Access policy that determines the user's location based on the actual physical location of the device rather than the IP address, while minimizing false positives. What should you configure?

Accepted Answer

Create a countries named location with 'Determine location by GPS coordinates' enabled and use it in a Conditional Access policy that blocks all countries except the US and Canada

Answer

Create an IP ranges named location containing the corporate egress IP addresses and exclude it from the blocking policy

Answer

Enable Continuous Access Evaluation so that location changes are re-evaluated in near real time

Answer

Configure a trusted named location and require the device to be marked as compliant in the grant controls