Conditional Access Problems

How to Require a VPN for Microsoft 365 Access Outside a Country

John Wilson Oct 21, 2026 868 views

Question details

The user needs to configure a Conditional Access policy that restricts Microsoft 365 access to a specific country unless connected to a VPN, but the policy is inadvertently blocking the VPN authentication.

How to Require a VPN for Microsoft 365 Access Outside a Country

Product: Microsoft 365 / Microsoft Entra ID
Device & OS: not provided
Scenario: Enforcing geographic access restrictions while allowing VPN access for remote users outside the designated country.
Observed behavior: A Conditional Access policy designed to block out-of-country Microsoft 365 access also blocks users from authenticating into their VPN, creating a lockout loop because the VPN relies on Microsoft 365/Entra ID for login.

Before you start

Ensure you have Conditional Access Administrator or Global Administrator privileges in Microsoft Entra ID before making policy changes.

Solution 1Recommended

Exclude the VPN Application from the Geo-Blocking Policy

Bypass the location restriction specifically for the VPN authentication app so users can successfully connect to the VPN from abroad.

When your VPN relies on Microsoft Entra ID for Single Sign-On (SSO), it acts as a cloud application. If your geographic block policy applies to 'All cloud apps', it will block the VPN login attempt from outside the country. Excluding the VPN's enterprise application from this policy allows the authentication to proceed.

Access Conditional Access Policies

Sign in to the Microsoft Entra admin center, navigate to 'Protection', and select 'Conditional Access' followed by 'Policies'.

Edit the Geo-Blocking Policy

Click on the specific Conditional Access policy that blocks access outside your designated country.

Exclude the VPN App

Under 'Target resources' (or Cloud apps), click on the 'Exclude' tab. Choose 'Select excluded cloud apps' and search for your VPN's Enterprise Application (e.g., Cisco AnyConnect, Palo Alto GlobalProtect, or Azure VPN).

Save and Test

Check the box next to your VPN application, click 'Select', and then click 'Save' at the bottom of the policy page. Test the VPN login from an external location to ensure the block is lifted.

Exclude the VPN Application from the Geo-Blocking Policy

Security Tip: Excluding the VPN app from the block policy only allows the VPN login. Once connected, the user's traffic will route through the VPN's IP address, which should be located within your allowed country.

Solution 2

Configure Named Locations for VPN IP Addresses

Define your VPN egress IP addresses as trusted locations to bypass Conditional Access restrictions.

Solution 3

Consult Azure Support for Complex Authentication Flows

Reach out to Azure specialists if tenant configurations or complex routing cause persistent authentication loops.

Free Microsoft Office alternative

Need a Reliable Office Suite Without Complex Cloud Restrictions?

Managing Microsoft 365 Conditional Access policies can be highly complex and often interrupts remote work. If you need a robust, offline-friendly productivity suite that doesn't rely on strict Entra ID cloud rules, WPS Office is the perfect alternative.

1. Download the Installer: Visit the official WPS Office website and download the free installer for your operating system.
2. Install WPS Office: Run the installer and follow the quick on-screen instructions to set up the software.
3. Open Microsoft Formats Instantly: Double-click any existing .docx, .xlsx, or .pptx files to open them securely in WPS Office, even without internet access.

Completely free and lightweight office suite for individuals and teamsExcellent compatibility with Microsoft Word, Excel, and PowerPoint formatsWorks perfectly offline, bypassing the need for complex VPN or cloud access policiesFamiliar interface ensures a seamless transition for Microsoft Office users

microsoft office alternative - wps office

Frequently Asked Questions

Why is my VPN blocked by Microsoft 365 Conditional Access?

If your VPN uses Microsoft Entra ID (formerly Azure AD) for user authentication, it acts as a cloud app. A Conditional Access policy set to block access from outside a specific country will also block the login attempt to the VPN itself unless the VPN application is explicitly excluded from the policy.

How do I exclude an application from a Conditional Access policy?

In the Microsoft Entra admin center, navigate to Protection > Conditional Access > Policies. Select your policy, click on 'Target resources' (or Cloud apps), switch to the 'Exclude' tab, and search for the application you want to bypass the rules.

Can I use Named Locations to bypass geographic restrictions?

Yes. You can define your corporate VPN's public IP addresses as a Trusted Named Location in Entra ID. You can then configure your Conditional Access policies to exclude this trusted location, ensuring users connected to the VPN are never blocked.

Microsoft Office Security Issues