---

In an age of increasing cyber threats and remote work, securing access to cloud-based systems like Microsoft Dynamics 365 is more critical than ever. While authentication methods like Multi-Factor Authentication (MFA) protect against unauthorized logins, IP restriction policies serve as a valuable perimeter defense by ensuring that only approved networks or devices can access your environment.

This article explores how IP restriction policies work with Dynamics 365 (D365), how to implement them using Microsoft Entra Conditional Access, and best practices for maintaining both security and usability.

---

What Are IP Restriction Policies?

IP restriction policies are rules that allow or deny user access based on the source IP address from which a sign-in request originates. For Dynamics 365, this means administrators can limit access to trusted networks—like company offices, VPNs, or specific geolocations—while blocking access from unknown, high-risk, or public internet locations.

These policies don’t replace identity-based security measures like MFA or password policies—they enhance them by adding a network layer of control.

---

Why Use IP Restrictions for Dynamics 365?

There are several compelling reasons to deploy IP restriction policies in a D365 environment:

Benefit	Explanation
Improved Security	Restricts access to trusted IP addresses, blocking unauthorized or risky connections.
Regulatory Compliance	Helps meet requirements for data sovereignty, access control, and risk management.
Reduced Attack Surface	Prevents exposure to brute-force attacks or password spray attempts from unknown locations.
Control for Remote Access	Allows businesses to enforce access through secure VPN or managed devices.
Audit Readiness	Supports clear documentation of access boundaries and control mechanisms.

In essence, IP restriction policies help enforce the principle of least privilege, not just at the identity level, but at the network level too.

---

How IP Restriction Works in Microsoft’s Ecosystem

In Microsoft cloud environments, IP-based restrictions are implemented using Conditional Access Policies in Microsoft Entra ID (formerly Azure AD). Every sign-in to Dynamics 365 is routed through Entra ID, where policies evaluate multiple factors, including:

• User identity
• Device compliance
• Location (IP address)
• Application being accessed
• Risk level

You can use Conditional Access to either:

• Block access entirely from unapproved IPs, or
• Require additional authentication (like MFA) from less secure networks

---

How to Set Up IP Restriction for Dynamics 365

Here’s a step-by-step guide to applying IP-based access restrictions for D365 users using Conditional Access.

---

✅ Step 1: Define Named Locations

1. Go to the Microsoft Entra Admin Center: https://entra.microsoft.com
2. Navigate to Protection > Conditional Access > Named Locations
3. Click + IP ranges location
   • Name your location (e.g., “Head Office” or “Corporate VPN”)
   • Enter IPv4/IPv6 ranges
   • (Optional) Mark as a trusted location for additional context

Named locations act as reusable building blocks for Conditional Access policies.

---

✅ Step 2: Create a Conditional Access Policy

1. In Entra Admin Center, go to Conditional Access > Policies
2. Click + New Policy and give it a clear name (e.g., “Restrict D365 to Corp IPs”)
3. Assignments:
   • Users or groups: Start with a test group or specific roles like admins
   • Cloud apps: Select Dynamics 365 or All cloud apps if broader control is needed
4. Conditions:
   • Under Locations, select:
     • Include: Any location
     • Exclude: Named location(s) you defined in Step 1
5. Access controls:
   • Choose Block access
6. Save and deploy in Report-only mode first for validation

---

✅ Step 3: Monitor and Enforce

Use Sign-in Logs under Monitoring > Sign-in logs to validate the policy in action. Once verified, switch from report-only to On.

---

Example Use Case

Scenario: A healthcare organization wants to restrict Dynamics 365 access to their office locations and VPN network, ensuring no user can log in from a personal device over public Wi-Fi.

Solution:

• Define IP ranges for each office and VPN gateway
• Create Conditional Access policy:
  • Include all users
  • Exclude only trusted IPs
  • Block access from all others
• Allow service accounts or app users via exclusions

Result:

The organization reduces the risk of PHI (Protected Health Information) exposure while remaining HIPAA compliant.

---

What Happens When a User Tries to Connect?

• If the user’s IP matches an excluded trusted location, the sign-in proceeds normally (subject to other policies like MFA or device compliance).
• If the IP does not match, the user is blocked with a message: “Your sign-in was blocked due to your organization’s policy.”

This is especially effective against malicious actors attempting to log in from foreign or unknown networks.

---

Things IP Restrictions Can’t Do

While powerful, IP restrictions have limitations:

Limitation	Explanation
No effect on legacy protocols	Older services not using modern authentication won’t be protected unless blocked separately.
Doesn’t apply to app registrations	Server-to-server (S2S) authentication via app users isn’t subject to Conditional Access.
Mobile users may experience issues	Mobile networks often use rotating IPs, leading to unintended blocks.
Overly strict policies may lock out admins	Always configure break-glass accounts exempt from CA policies.

---

Best Practices for IP Restriction Policies

To ensure effectiveness and minimize disruptions, consider the following:

Best Practice	Benefit
Use “Report-only” mode first	Test policies before enforcement to avoid lockouts
Define and label trusted IPs carefully	Ensure VPNs, office networks, and other endpoints are included
Exclude emergency (break-glass) accounts	Maintain administrative access in case of misconfiguration
Document and review policies quarterly	Keep up with changing infrastructure (e.g., new offices, VPN changes)
Combine with MFA and device compliance	Enhance security through a layered defense approach
Log and monitor access attempts	Identify and investigate sign-ins from untrusted IPs

---

Monitoring IP-Based Access

The Microsoft Entra Sign-In Logs give insight into access attempts:

• View successful and blocked logins
• Filter by app (Dynamics 365), user, IP, and location
• Review Conditional Access policies applied per sign-in
• Identify users attempting access from risky or unknown locations

For advanced analysis, integrate logs with:

• Microsoft Sentinel
• Azure Log Analytics
• Power BI dashboards

---

Integration with Other Security Features

IP restriction should be deployed as part of a broader security strategy. It works well alongside:

• Multi-Factor Authentication (MFA)
• Device Compliance policies via Microsoft Intune
• Geofencing via Conditional Access (country-based filtering)
• Session controls for limiting data download in risky sessions
• Power Platform DLP policies for preventing data exfiltration

---

---