How to Enforce Conditional Access Policies Based on Risk and Location. Conditional access is a key part of modern IT security. It helps IT teams automatically control access using real-time signals like user risk, device compliance, and location. This guide explains how to use Microsoft Entra ID to apply conditional access based on risk and location. Before we begin, be sure to subscribe to NinjaOne’s IT video hub and our YouTube channel for more tech content like this. Method 1: Configuring via Microsoft Entra Admin Center. Configuring conditional access in the Microsoft Entra Admin Center is simple and managed through a graphical interface. It also supports more than just risk- and location-based access controls. To create a conditional access policy: Go to the Microsoft Entra Admin Center. Navigate to Protection, Conditional Access, Policies. Click + New policy. Define the following: Under Assignments: Users or groups Cloud apps or actions Conditions, Locations Conditions, Sign-in risk or User risk, then set level to Low, Medium, or High Under Access Controls: Make sure to block access Require Require multifactor authentication or MFA Require a compliant device Finally, enable and create the policy. Method 2: Defining Named Locations in Microsoft Entra Admin Center. This method lets IT administrators allow or block access based on a user’s location or IP address. To define locations: Go to Conditional Access, Named locations. Click + IP ranges location. Name the location. For example, you can name it “Corporate HQ”. Add trusted IP ranges or create a country-based name location. Use these locations in your conditional access policies. Be careful when naming locations, adding trusted IP ranges, or creating country-based policies, since incorrect settings can impact how conditional access works. Method 3: Creating Risk-based CA Policies in Microsoft Entra Admin Center. Risk-based conditional access helps protect accounts when credentials are compromised or sign-in activity appears risky. It can be combined with other conditions, like location, to provide stronger protection against common cyber threats. To use this method: Go to Protection, Identity Protection, User risk policy. Select the users to apply it to. Set the risk level to Medium or higher. Choose a control, such as block access or require a password reset. Repeat the steps for the Sign-in risk policy. Combine it with Conditional Access policies if you need more granular controls. Method 4: PowerShell. PowerShell is ideal for automation in large IT environments. It can be used to automate the creation and management of conditional access policies. Open PowerShell as an administrator. Connect to Microsoft Graph PowerShell using this command... Run this command to create a conditional access policy... Use this command to manage named locations: Conditional access policies give IT teams granular control over user access based on risk and location. Our guide has shown how to create and enforce these policies using the Microsoft Entra Admin Center and PowerShell. For more information, check out our official blog post on enforcing Conditional Access Policies linked in the description below.