Control: 2.2.1 Ensure Trusted Locations Are Defined

Description

Microsoft Entra ID Conditional Access allows an organization to configure Named locations and configure whether those locations are trusted or untrusted. These settings provide organizations the means to specify Geographical locations for use in conditional access policies, or define actual IP addresses and IP ranges and whether or not those IP addresses and/or ranges are trusted by the organization.

Defining trusted source IP addresses or ranges helps organizations create and enforce Conditional Access policies around those trusted or untrusted IP addresses and ranges. Users authenticating from trusted IP addresses and/or ranges may have less access restrictions or access requirements when compared to users that try to authenticate to Microsoft Entra ID from untrusted locations or untrusted source IP addresses/ranges.

Remediation

From Azure Portal

In the Azure Portal, navigate to Microsoft Entra ID.
Under Manage, click Security.
Under Protect, click Conditional Access.
Under Manage, click Named locations.
Within the Named locations blade, click on IP ranges location.
Enter a name for this location setting in the Name text box.
Click on the + sign.
Add an IP Address Range in CIDR notation inside the text box that appears.
Click on the Add button.
Repeat steps 7 through 9 for each IP Range that needs to be added.
If the information entered are trusted ranges, select the Mark as trusted location check box.
Once finished, click on Create.

From PowerShell

Create a new trusted IP-based Named location policy

[System.Collections.Generic.List`1[Microsoft.Open.MSGraph.Model.IpRange]]$ipRanges = @()
$ipRanges.Add("<first IP range in CIDR notation>")
$ipRanges.Add("<second IP range in CIDR notation>")
$ipRanges.Add("<third IP range in CIDR notation>")
New-MgIdentityConditionalAccessNamedLocation -dataType "#microsoft.graph.ipNamedLocation" -DisplayName "<name of IP Named location policy>" -IsTrusted $true -IpRanges $ipRanges

Set an existing IP-based Named location policy to trusted

Update-MgIdentityConditionalAccessNamedLocation -PolicyId "<ID of the policy>" -dataType "#microsoft.graph.ipNamedLocation" -IsTrusted $true

Default Value

By default, no locations are configured under the Named locations blade within the Microsoft Entra ID Conditional Access blade.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.cis_v300_2_2_1

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.cis_v300_2_2_1 --share

SQL

This control uses a named query:

with distinct_tenant as (
  select
    distinct tenant_id,
    subscription_id,
    _ctx
  from
    azure_tenant
)
select
  id as resource,
  case
    when (location_info -> 'IsTrusted')::bool then 'ok'
    else 'alarm'
  end as status,
  case
    when (location_info -> 'IsTrusted')::bool then title || ' trusted location configured.'
    else title || ' trusted location not configured.'
  end as reason,
  t.tenant_id
  
from
  distinct_tenant as t,
  azuread_conditional_access_named_location;