(L2) Ensure trusted 'named locations' are defined

Contributed by jeremy finneyAll contributors →

Part of CIS · Entra ID · Conditional Access · All checks

Run this check

Invoke-Maester -TestId CIS.M365.5.2.2.14

Overview

At least one IP-based named location with address ranges exists and is marked as trusted.

Named locations give Conditional Access a way to tell your offices and known egress addresses from the rest of the internet. Marked as trusted, they feed Microsoft Entra ID Protection and let policies relax or tighten requirements by network.

The test passes when at least one IP named location has ranges and is trusted. Country-based locations are not counted. Only mark a network as trusted when it is under your control.

Remediation action

1. Sign in to the Microsoft Entra admin center.
2. Go to Entra ID > Conditional Access > Named locations.
3. Select IP ranges location.
4. Enter a name and add the public IP ranges of your offices or egress points.
5. Select Mark as trusted location and then Create.

Related links

• Microsoft Entra admin center - Named locations
• Conditional Access: network assignments
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.2.14

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.5.2.2.14
Severity	Low
Suite	CIS
Product	Entra ID
Feature	Conditional Access
Area	Access control
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	None
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.2.14
Benchmark level	L2
Benchmark profiles	E3 Level 2
Supports controls	cis-m365:5.2.2.14, nist-800-53-r5:AC-3
PowerShell test	Test-MtCisTrustedNamedLocation
Services	Graph
Compatible licenses	AAD_PREMIUM

Source

• Test: tests/cis/Test.CIS.M365.5.2.2.14.ps1
• Documentation: tests/cis/Test.CIS.M365.5.2.2.14.md