Named Locations & Trusted IP Audit

The question it answers: Which trusted named locations are too wide, and which named locations does no Conditional Access policy use?

Conditional Access policies often skip MFA inside ‘trusted’ locations. A trusted range that is too wide - a /8, a whole cloud provider, 0.0.0.0/0 - quietly switches MFA off for anyone connecting from it. Locations no policy uses are clutter that hides the ones that matter.

Note

Trusted locations also count as used when a policy targets ‘All trusted locations’. IPv6 ranges are compared as if /32 were as broad as an IPv4 /16.

At a glance

Where in the app	Entra ID › Identity Hygiene › Named Locations & Trusted IPs
Workload	Entra ID
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Entra ID P1.
Report id (API and MCP)	entra.ca.named-location-audit

Columns

Column	Key	Type
Location	DisplayName	Text
Type	Category	Status
Finding	Finding	Status
Used by	Value	Text
Ranges / countries	Detail	Text
Modified	Date	Date

What it needs

Licence: Microsoft Entra ID P1.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Policy.Read.All	Microsoft Graph	Read your organization’s policies

Data sources it reads

• GET /v1.0/identity/conditionalAccess/namedLocations
• GET /v1.0/identity/conditionalAccess/policies

Through the API and MCP

GET /ir-api/v1/reports/entra.ca.named-location-audit?size=100

An AI assistant reads it with the MCP tool get_report and the id entra.ca.named-location-audit. The client needs the Read grant for Entra ID. See Using the API.