Conditional access for international travel

Hello @Cathy Olieslaeger,

We can create a conditional access policy which blocks the users from non-US IP Addresses.

Make sure that you first test it with a specific user or set of users and exclude global admins from it to prevent tenant lockout scenarios. Please find the steps below-

Navigate to Entra ID > Security > Conditional Access > Manage > Named Locations > Countries location and create a named location for US.

Once you create it as shown in the above image now navigate to Conditional access policies > New Policy and create a policy by selecting all the appropriate conditions-

Users - Select users on whom you would like to apply

Target Resources - Select all apps or the apps you would like to apply the policy on

Network - Exclude the named location you had created as below image

and Grant control as "Block" and change the policy from report only to On. This conditional access policy blocks all the users who are trying to access your resources from any location except the location you had excluded i.e., US locations. Please make sure that you exclude the global admins while creating the policy to prevent tenant lockouts.

If you want to configure an exclusion for any user who is travelling abroad, then please exclude the user from the policy during the travel and re-include the user once they are back. Unfortunately, there is no specific control based on time period in the conditional access policy.

This can be setup for users and also users using specific devices and these can be configured in Filter for devices in the same CA policy by using Inclusions and Exclusions based on requirement. It is suggested to use the location-based CA policies on Users rather than User devices.

Alternatively, you can also configure a CA policy for users to access the resources only from specific devices.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

@Swaroop Kolli So there is no more granular way to grant access? Example: We are blocking all non-US IP addresses, but we want one user to work from the UK. Besides creating a named IP location and whitelisting endless IP addresses when they change locations or networks, is there a way to whitelist only the UK for this individual?

Thank you!