Forum Discussion

shane_foley's avatar
shane_foley
Brass Contributor
Oct 02, 2020

Conditional access policy & IPv6

Hi there, I created a conditional access policy to block all locations, excluding Australia and Singapore. This works great for users logging in using IPv4, however it blocks those using IPv6. I log...
Conditional Access
Thijs Lecomte's avatar
Thijs Lecomte
Bronze Contributor
Oct 02, 2020
Unfortunately there isn't much to say.

I agree that IPv6 support is needed. But as of now, it's not supported in Conditional Access.

Microsoft is aware of this, but I don't know of any timeline when this will be implemented
  • shane_foley's avatar
    shane_foley
    Brass Contributor
    Oct 04, 2020

    Thijs Lecomte Hi there Thijs. What I've had to do is to create a named location and tick the " Include unknown areas" option. I've added this location as an exclusion to the policy. Not ideal, but any IPv6 traffic should now be allowed.

    • Todd_Kearney's avatar
      Todd_Kearney
      Copper Contributor
      Apr 23, 2021

      shane_foley Not sure what your location is, or what you are trying to block, but for us we are in the US and trying to block non-US connection attempts.    To accomplish this we setup a location for US IPv6 addresses and added all of the US IPv6 blocks:

      2001:4800::/23
      2001:0400::/23
      2001:1800::/23
      2001:4800::/23
      2600:0000::/12
      2610:0000::/23
      2620:0000::/23
      2630:0000::/12
      • ivassallo19's avatar
        ivassallo19
        Copper Contributor
        Mar 31, 2022

        Todd_Kearney 

        Well that seems a smart way to do it. And seems like how Microsoft should end up doing it, by assigning a block to a country.

        But here in Australia, when I find a website that generates a list of IPv6 blocks, the list is ~1500 long.

Resources