Conditional Access Problems

How to Use Conditional Access to Block Microsoft 365 Access Outside a Network

Phi Hung Vo Oct 21, 2026 868 views

Question details

Administrators need to configure Microsoft Entra ID to restrict Microsoft 365 access exclusively to trusted corporate network locations.

How to Use Conditional Access to Block Microsoft 365 Access Outside a Network

Product: Microsoft Entra ID
Device & OS: not provided
Scenario: Securing organizational cloud applications by preventing unauthorized sign-ins from external or unknown public IP addresses.
Observed behavior: Microsoft 365 is currently accessible from any location, and the goal is to enforce a strict network-based boundary blocking all outside access.

Before you start

Verify that your tenant has Microsoft Entra ID P1 or P2 licenses, and ensure you have created an emergency 'break-glass' administrator account excluded from all policies to prevent accidental tenant lockouts.

Solution 1Recommended

Configure Location-Based Block Policy in Microsoft Entra ID

Define your trusted corporate public IP ranges in Entra ID and create a Conditional Access policy that blocks access from any location outside those defined boundaries.

Microsoft Entra Conditional Access relies on 'Named locations' to identify trusted network boundaries. By configuring a policy that includes all locations but explicitly excludes your trusted named locations, you ensure that external connections are reliably blocked.

Define Trusted Network Locations

Log in to the Microsoft Entra admin center. Navigate to Protection > Conditional Access > Named locations. Click 'IP ranges location', provide a name (e.g., 'Corporate HQ'), add your organization’s public IP ranges, mark them as trusted, and save.

Create a New Conditional Access Policy

Under the Conditional Access menu, select 'Policies' and click 'New policy'. Give your policy a descriptive name, such as 'Block Microsoft 365 Outside Corporate Network'.

Assign Users and Target Cloud Apps

Under 'Users', select the specific groups you want to target, ensuring you exclude your emergency administrator accounts. Under 'Target resources', select 'Cloud apps' and choose 'Office 365' or specific applications you want to protect.

Configure Network Location Conditions

Click on 'Conditions', then select 'Locations'. Toggle 'Configure' to Yes. Under the 'Include' tab, select 'Any location'. Switch to the 'Exclude' tab, select 'Selected locations', and check the trusted named location you created in the first step.

Set Access Controls to Block

Under the 'Access controls' section, click on 'Grant'. Select 'Block access' and click Select to apply the control.

Test with Report-Only Mode

Set the 'Enable policy' toggle at the bottom to 'Report-only'. Test the configuration with a pilot group by reviewing the Entra ID sign-in logs. Once you verify legitimate access is unaffected and external access is blocked, switch the policy to 'On'.

Configure Location-Based Block Policy in Microsoft Entra ID

Endpoint Manager Integration: If you are utilizing third-party endpoint managers (such as Todily) instead of Microsoft Intune, verify with their documentation how they pass device compliance states to Entra ID, as network location blocking operates independently of device management.

Free Microsoft Office alternative

Looking for a Cost-Effective Office Suite?

While enterprise environments require strict administrative controls like Entra Conditional Access for Microsoft 365, these enterprise tiers come with high licensing costs. If your organization or team is looking for a lightweight, powerful, and budget-friendly alternative for document processing, consider WPS Office.

1. Download and Install: Visit the official WPS Office website to download the free installer for your Windows, Mac, or Linux device.
2. Open Microsoft Formats: Launch WPS Office and directly open your existing .docx, .xlsx, or .pptx files without any conversion.
3. Work Securely: Utilize built-in document encryption and permission settings to keep your local business files secure.

Free and lightweight alternative to costly Microsoft 365 enterprise plansSeamlessly compatible with Microsoft Word, Excel, and PowerPoint file formatsBuilt-in PDF editing tools for comprehensive document managementFamiliar user interface requiring zero learning curve for immediate productivity

microsoft office alternative - wps office

Frequently Asked Questions

Why did I get locked out after enabling the block policy?

If your current IP address was not included in the trusted named location, or if you failed to exclude your admin account from the policy, the block rule applied to you. Always use 'Report-only' mode first and configure an excluded 'break-glass' account.

Does this Conditional Access policy block remote workers on VPN?

If remote workers are connected to a corporate VPN that routes their internet traffic through the trusted public IP ranges defined in your named locations, they will not be blocked. Split-tunnel VPNs that bypass corporate IPs will be blocked.

Can I use Conditional Access without Microsoft Intune?

Yes. Network location-based Conditional Access policies are configured directly in Microsoft Entra ID (formerly Azure AD) and do not strictly require Intune unless you are enforcing device compliance conditions alongside location conditions.

Can I block specific apps instead of all Microsoft 365 services?

Yes. When configuring the policy under 'Target resources', you can choose 'Select apps' and specifically target applications like Exchange Online or SharePoint Online rather than the entire Office 365 suite.

Microsoft Office Security Issues