CIS.M365.5.2.2.14 - (L2) Ensure trusted 'named locations' are defined
Overview
At least one IP-based named location with address ranges exists and is marked as trusted.
Named locations give Conditional Access a way to tell your offices and known egress addresses from the rest of the internet. Marked as trusted, they feed Microsoft Entra ID Protection and let policies relax or tighten requirements by network.
The test passes when at least one IP named location has ranges and is trusted. Country-based locations are not counted. Only mark a network as trusted when it is under your control.
Remediation action
- Sign in to the Microsoft Entra admin center.
- Go to Entra ID > Conditional Access > Named locations.
- Select IP ranges location.
- Enter a name and add the public IP ranges of your offices or egress points.
- Select Mark as trusted location and then Create.
Related links
- Microsoft Entra admin center - Named locations
- Conditional Access: network assignments
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.2.14
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.2.2.14 |
| Severity | Low |
| Suite | CIS |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Access control |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | None |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.2.14 |
| Benchmark level | L2 |
| Benchmark profiles | E3 Level 2 |
| Supports controls | cis-m365:5.2.2.14, nist-800-53-r5:AC-3 |
| PowerShell test | Test-MtCisTrustedNamedLocation |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
- Test:
tests/cis/Test.CIS.M365.5.2.2.14.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.2.2.14.md