Question

Your organization runs a critical daemon application registered as a service principal in Microsoft Entra ID. Security requires that this service principal only be permitted to obtain tokens when the request originates from your on-premises datacenter's public IP range. Recently, credentials for a similar app were leaked and abused from a foreign IP. You need to enforce a location restriction specifically on the service principal's sign-ins. Which solution should you implement?

Accepted Answer

Create a Conditional Access policy targeting workload identities, assign the service principal, and apply a Block control for all locations except the named location representing the datacenter IP range.

Answer

Configure a user risk-based Conditional Access policy that requires MFA when the service principal's risk level is elevated.

Answer

Add the datacenter IP range to the trusted IPs in the multifactor authentication service settings for the service principal.

Answer

Enable Continuous Access Evaluation for the service principal so tokens are revoked when the IP address changes.