Conditional Access Problems

How to Block Dynamics 365 Access Outside the Corporate Network

Muhammad Talha Oct 16, 2026 868 views

Question details

The user wants to configure a network-based restriction for Microsoft Dynamics 365, ensuring it is only accessible from within the corporate network, but is having trouble locating the correct Dynamics app in Microsoft Entra.

How to Block Dynamics 365 Access Outside the Corporate Network

Product: Microsoft Dynamics 365 / Microsoft Entra ID
Device & OS: not provided
Scenario: Setting up Conditional Access policies in Microsoft Entra ID to restrict external network access to Dynamics 365 business applications.
Observed behavior: The user needs to apply network-location restrictions, but the main Dynamics application is missing from the Microsoft Entra application list, with only Dynamics 365 Business Central being visible.

Before you start

Ensure you have Conditional Access Administrator or Global Administrator privileges in your Microsoft Entra ID tenant, and have predefined your corporate network's IP ranges in the Named Locations settings.

Solution 1Recommended

Create a Conditional Access Policy for Dynamics 365

Create and enforce a network-location-based Conditional Access policy in Microsoft Entra ID to block external IP ranges.

This policy will block sign-in attempts to Dynamics 365 that originate from outside your trusted corporate network.

Access Conditional Access settings

Define user scope and exclusions

Click 'Create new policy'. Under 'Users', select the users or groups subject to this restriction. Select the 'Exclude' tab and ensure you add your emergency-access (break-glass) accounts to prevent tenant lockout.

Select the target application

Under 'Target resources' (or Cloud apps), click 'Select apps'. Search for 'Dynamics 365' or 'Dynamics 365 Business Central' and select it.

Configure location conditions

Under 'Conditions', select 'Locations'. Configure the policy to include 'Any location', and under the 'Exclude' tab, select your preconfigured corporate 'Named locations' (trusted IPs).

Enforce the block

Under 'Access controls', choose 'Grant', select 'Block access', and switch the policy state from 'Report-only' to 'On'. Click 'Create' to enforce the rule.

Create a Conditional Access Policy for Dynamics 365

Emergency Accounts: Always exclude at least one highly privileged emergency-access account. If the location policy is misconfigured or your corporate IP changes unexpectedly, this account ensures you can still access the tenant to fix the policy.

Solution 2

Troubleshoot Missing Dynamics Applications in Entra ID

Steps to take if the specific Dynamics 365 application you need to restrict is missing from the Cloud Apps selection list.

Free Microsoft Office alternative

Looking for a Lightweight Office Alternative?

While securing enterprise platforms like Dynamics 365 requires complex Azure policies, managing your team's daily document tasks shouldn't be difficult or expensive. WPS Office is a fast, powerful, and free alternative to Microsoft Office that easily handles all your standard document needs.

1. Download WPS Office: Visit the official WPS Office website and download the free installer for your operating system.
2. Install the software: Run the downloaded installer and follow the simple on-screen instructions to set up the software.
3. Open your files: Launch WPS Office and directly open your existing Word, Excel, or PowerPoint documents with all formatting retained perfectly.

Fully compatible with Microsoft Office formats including .docx, .xlsx, and .pptx.Lightweight application that requires fewer system resources than traditional enterprise suites.Familiar tabbed interface ensuring zero learning curve for your team.Built-in PDF editing tools for comprehensive document management.

microsoft office alternative - wps office

Frequently Asked Questions

What are emergency-access accounts in Conditional Access?

Emergency-access, or 'break-glass', accounts are highly privileged administrative accounts that are explicitly excluded from strict Conditional Access policies. They exist to prevent a total tenant lockout if a policy is misconfigured or if there is an issue with your corporate network's IP addresses.

Why is my specific Dynamics 365 app missing from the Conditional Access cloud apps list?

The application might not have a service principal registered in your specific Entra tenant, or your subscription might map to a broader, unified application category under Microsoft's backend. In such cases, checking 'All applications' or contacting Azure support is necessary.

Can I restrict Dynamics 365 access to specific IP ranges instead of whole countries?

Yes. You can define 'Named locations' in Microsoft Entra ID using specific IPv4 or IPv6 network ranges. You can then configure your Conditional Access policy to block access from 'Any location' while excluding these trusted Named locations.

Will blocking external access affect Dynamics 365 mobile app users?

Yes. If mobile users are not connected to the corporate network (e.g., via a corporate VPN that routes their traffic through your trusted IPs), their access will be blocked by the Conditional Access policy.

Microsoft Office Security Issues