Conditional Access Problems

How to Restrict Microsoft 365 Admin Portal Access by Public IP Address

Guest Writer Oct 10, 2026 869 views

Question details

An organization needs to restrict access to the Microsoft 365 admin portal strictly to corporate public IP addresses.

Restrict Microsoft 365 Admin Portal Access by Public IP Address

Product: Microsoft 365
Device & OS: not provided
Scenario: Securing administrative portal access by requiring remote administrators to connect through the corporate VPN to use a trusted public IP.
Observed behavior: The goal state is that administrators can only log into the Microsoft 365 admin portals from approved company IP addresses, with all outside access blocked.

Before you start

Ensure you have the necessary Microsoft Entra ID P1 or P2 licenses for Conditional Access and verify that you have a dedicated emergency 'break-glass' administrator account excluded from these policies to prevent accidental lockouts.

Solution 1Recommended

Configure Microsoft Entra Conditional Access Policy

Use Microsoft Entra Conditional Access to define your company's IP ranges as named locations and block administrative access from outside these trusted networks.

By configuring Named Locations and Conditional Access, you can ensure that highly privileged accounts only access the admin portals from authorized enterprise networks. Remote users will be forced to connect via the corporate VPN.

Create a named location

Sign in to the Microsoft Entra admin center. Navigate to Protection > Conditional Access > Named locations. Click 'IP ranges location', name it 'Corporate Public IPs', enter your company's public IPv4/IPv6 ranges, mark as trusted, and save.

Create a new Conditional Access policy

Go to Protection > Conditional Access > Policies and select 'New policy'. Name the policy appropriately, such as 'Block Non-Corporate IP Admin Access'.

Target administrators and portals

Under 'Users', select the specific administrator roles or user groups you want to target. Under 'Target resources', select the relevant Microsoft admin portals or cloud apps.

Configure location conditions

Under 'Conditions' > 'Locations', configure the policy to include 'Any location' and strictly exclude the 'Corporate Public IPs' named location you just created.

Set access controls to block

Under 'Access controls' > 'Grant', select 'Block access'. This ensures anyone not coming from the excluded trusted location will be blocked.

Test and enable the policy

Set the policy to 'Report-only' first to test its impact. Once confirmed it works as expected without blocking valid access, change it to 'On'. Ensure your break-glass account is excluded from the 'Users' assignment.

Configure Microsoft Entra Conditional Access Policy

Break-glass Account: Always exclude at least one emergency access administrator account from this Conditional Access policy to avoid a total tenant lockout if your corporate IPs change or the VPN goes down.

Free Microsoft Office alternative

Manage Your Organization's Documents with WPS Office

While Microsoft Entra handles your network security and access policies, providing your team with cost-effective, high-performance office software is equally important. WPS Office is a lightweight, fully compatible alternative to Microsoft Office that meets enterprise document management needs without the heavy subscription costs.

1. Download the software: Visit the official WPS Office website and download the free installer for your operating system.
2. Install WPS Office: Run the downloaded installer and follow the quick on-screen instructions to complete the setup.
3. Open existing documents: Launch WPS Office to immediately start opening, editing, and saving your existing Microsoft Office files with perfect format compatibility.

Fully compatible with Microsoft Office formats including Word, Excel, and PowerPoint.Lightweight software architecture that runs smoothly on standard enterprise hardware.Familiar user interface, requiring zero learning curve for seamless team migration.Cost-effective solution with rich document editing, PDF conversion, and collaboration features.

microsoft office alternative - wps office

Frequently Asked Questions

What happens if our corporate public IP address changes?

If your ISP changes your public IP address and it is not updated in the Microsoft Entra Named Locations, administrators will be blocked from accessing the portal. You will need to use your emergency 'break-glass' account (which should be excluded from the policy) to log in and update the IP ranges.

Do remote administrators have to use a VPN?

Yes, if this Conditional Access policy is enforced, remote administrators must connect to the corporate VPN so their internet traffic routes through the trusted corporate public IP address before accessing the Microsoft 365 admin portal.

Can I use Global Secure Access instead of traditional VPNs?

Yes, Microsoft Entra Global Secure Access can also be used to route traffic and verify network conditions. Conditional Access policies can be integrated with Global Secure Access to achieve similar security goals without relying on traditional VPN routing.

Microsoft Office Security Issues