Grain-elevator engineers may manage Azure only from the plant’s egr…

Question

Grain-elevator engineers may manage Azure only from the plant’s egress IP ranges; traffic from any other network must require MFA and a compliant device or be blocked. Which Conditional Access element expresses that network boundary for Azure portal work?

Accepted Answer

Define a named location for the plant egress ranges and use it as a location condition on the Conditional Access policy for Azure management. — Named locations are the plant fence line inside Conditional Access: “if you’re coming from these egress IPs, treat the session as on-site.” That condition lives on the identity policy—not on an NSG glued to someone’s laptop.

Answer

Attach an NSG to each engineer’s laptop NIC so only plant IP ranges reach Microsoft endpoints.

Answer

Create a Private Endpoint for every Azure resource the engineers touch so location conditions become unnecessary.

Answer

Place Azure Firewall in front of Entra ID so Conditional Access location conditions are evaluated inside the VNet.

Grain-elevator engineers may manage Azure only from the plant’s egress IP ranges; traffic from any other network must require MFA and a compliant device or be blocked. Which Conditional Access element expresses that network boundary for Azure portal work?

Short Explanation

Full Explanation