Conditional access policy & IPv6

[shane_foley]

Hi there,

I created a conditional access policy to block all locations, excluding Australia and Singapore. This works great for users logging in using IPv4, however it blocks those using IPv6. I logged a call with MS and got confirmation that "at the moment by Design, the Countries tab in Conditional Access feature does not include IPV6 addresses option. It only covers IPV4.".

One of the largest ISPs (if not the largest) here in Australia uses dynamic IPv6 by default! Loction can't be be mapped to Australia, so conditional access blocks the sign in!

Why can't Conditional Access do an IPv6 lookup? Thats what the team over at APNIC do?

Any thoughts on the matter?

Ta.

[#2]

Unfortunately there isn't much to say.

I agree that IPv6 support is needed. But as of now, it's not supported in Conditional Access.

Microsoft is aware of this, but I don't know of any timeline when this will be implemented

[#3]

@Thijs Lecomte Hi there Thijs. What I've had to do is to create a named location and tick the " Include unknown areas" option. I've added this location as an exclusion to the policy. Not ideal, but any IPv6 traffic should now be allowed.

[#4]

@shane_foley Not sure what your location is, or what you are trying to block, but for us we are in the US and trying to block non-US connection attempts.    To accomplish this we setup a location for US IPv6 addresses and added all of the US IPv6 blocks:

2001:4800::/23

2001:0400::/23

2001:1800::/23

2001:4800::/23

2600:0000::/12

2610:0000::/23

2620:0000::/23

2630:0000::/12

[#5]

@Todd_Kearney 

Well that seems a smart way to do it. And seems like how Microsoft should end up doing it, by assigning a block to a country.

But here in Australia, when I find a website that generates a list of IPv6 blocks, the list is ~1500 long.