entra id named locations vs trusted ips: migration steps

TL;DR

Named locations replaced the old trusted-IPs list in Conditional Access. Migration means inventorying the current trusted IPs, recreating each as a named location marked trusted where appropriate, updating every Conditional Access policy to reference the named location, and only then removing the legacy list.

The query

entra id named locations vs trusted ips: migration steps

Use this when

• Conditional Access policies still using the legacy trusted IPs setting
• adding a new office range to the trusted set
• auditing which policies depend on location trust

Not for

• designing location-based policy from nothing (start with named locations directly)
• IPv6 ranges your apps do not see (verify what the apps log)
• skipping the test step on a Friday afternoon

Steps

1. Document every IP range in the trusted IPs list and what each range is for. Expected output: a complete inventory with owners
2. In Entra admin center, create a named location for each range, marking corporate ranges as trusted. Expected output: named locations mirror the old list
3. Open each Conditional Access policy that references trusted IPs and switch the location condition to the matching named location. Expected output: no policy still uses the legacy setting
4. Test with one user on the corporate network and one off it. Expected output: corporate users get the trusted experience and others do not
5. Remove the legacy trusted IPs list once migration is confirmed. Expected output: named locations are the single source of truth

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_66DU9Sx86QZMgJvMZJtnEQ