Azure AD conditional Access.

[Deleted]

Hi All,

I was looking for some insights on how large enterprises handle this situation.

Assuming you have IP based restrictions for SharePoint Online OR Conditional access where you created a named location with a set of IPS.
In a scenarios where on the network infrastructure is changed or updated/ new sites added/ circuits changed, how do large enterprises deal with handling this change?

For a large enterprise you could have multiple locations and a complex network, is there a best approach to handle change in the IPs so that users don't get locked out of Office 365?

Thanks,

Priyank

[#2 · Accepted solution]

If you're doing IP-based restrictions, then this becomes a change management issue. Before new IP ranges are added, or existing IP ranges are removed, you should include in your planning the steps to update your conditional access rules.

If IP-based restrictions are becoming unmanageable for you, consider moving to managed vs unmanaged device policies in conditional access instead. That way you aren't trusting networks (all networks should be untrusted these days), and you're focusing on securing identities and endpoints (devices) instead.

Here is a blog post on the topic if you're interested: https://practical365.com/security/azure-active-directory-conditional-access-enforce-multi-factor-aut...