When a user signs in, Azure AD resolves the user's IPv4 or IPv6 address (starting April 3, 2023) to a country or region, and the mapping updates periodically. If you select Determine location by IP address, the system collects the IP address of the device the user is signing into.

Optionally choose to Include unknown countries/regions.

Choose to determine location by IP address or GPS coordinates.

To define a named location by country/region, you need to provide: Organizations can determine country/region location by IP address or GPS coordinates. To find out more about Zero Trust and other ways to align your organization to the guiding principles, see the Zero Trust Guidance Center. Verify explicitly is a core principle of a Zero Trust architecture. Remove the trusted designation before attempting to delete.Įven if you know the network and mark it as trusted does not mean you should exclude it from policies being applied.

Locations marked as trusted can't be deleted.

Sign-ins from trusted named locations improve the accuracy of Azure AD Identity Protection's risk calculation, lowering a user's sign-in risk when they authenticate from a location marked as trusted.Conditional Access policies can include or exclude these locations.This marking is used by features in several ways. Locations such as your organization's public network ranges can be marked as trusted. Only CIDR masks greater than /8 are allowed when defining an IP range. The number of IP addresses contained in a range is limited.Both IPv4 and IPv6 ranges are supported.Configure up to 2000 IP ranges per named location.Named locations defined by IPv4/IPv6 address ranges are subject to the following limitations: To define a named location by IPv4/IPv6 address ranges, you need to provide:

Gps coordinates