Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000186

Private IP addresses in Entra ID Conditional Access policy

Medium
Entra ID
Defense Evasion Initial Access Persistence
v14

Signature Identity

CTD-000186
Threat ID
14
Version
IOE
Indicator Type

Threat Description

This detection identifies Conditional Access policies that include private IP address ranges (for example, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) in Named Locations. Because these ranges are non-routable and not globally unique, they provide an unreliable basis for enforcing access control boundaries.

Such configurations may enable threat actors to bypass Conditional Access restrictions if they are:

  • Operating from within corporate or partner networks,
  • Spoofing internal IPs through VPNs, or
  • Leveraging misconfigured proxies.

In addition, Microsoft Entra ID does not natively resolve internal IP addresses to hostnames, nor does it differentiate between multiple users behind a NAT device. As a result, private IP ranges are unsuitable for precise or secure access enforcement.

MITRE ATT&CK: Attack Tactics

Defense Evasion Initial Access Persistence

D3FEND: Defend Tactics

D3-NI (Network Isolation)

Remediation

To remove Private IPs from Conditional Access Named locations:

  1. Open Microsoft Entra Admin Center.
  2. Go to Entra ID > Security > Conditional Access > Named locations.
  3. Navigate to the Named locations referenced in the evidence.
  4. Look for any entries containing private IP ranges:
    • 10.0.0.0/8
    • 172.16.0.0/12
    • 192.168.0.0/16
  5. Edit Named locations by either remove the private IP ranges or mark the location as not trusted. Avoid using private IPs for any access decisions, especially MFA exemptions.
  6. Replace with verified public IPs:
    • Use NAT-ed public IPs from your corporate egress infrastructure.
    • Configure firewalls to ensure these IPs are only accessible from trusted networks.
  7. Clone the original Conditional Access policy and run in report-only mode to evaluate changes safely.
  8. Navigate to Sign-in logs and filter by location to validate policy impact.

Frequently Asked Questions

What does Private IP addresses in Entra ID Conditional Access policy mean?

Including private IP address ranges (such as 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16) in Named Locations within your Entra ID Conditional Access policies can lead to unreliable access control enforcement.

This issue is rated medium severity because including private IP ranges in Conditional Access policies allows attackers to bypass restrictions, even when operating from within corporate or partner networks. This risk is indirect but meaningful due to the inability of Microsoft Entra ID to resolve internal IP addresses to hostnames and differentiate between users behind a NAT device.

Attackers can spoof internal IPs through VPNs or misconfigured proxies, leveraging the inability of Microsoft Entra ID to resolve internal IP addresses to hostnames and differentiate between users behind a NAT device. This allows them to bypass access control boundaries and gain initial access.

Cayosoft Guardian continuously monitors Named Locations in your Entra ID Conditional Access policies for private IP ranges, flagging them as security issues and providing administrators with visibility into this setting.

Cayosoft Guardian alerts administrators to remove private IP ranges from Named Locations, replacing them with verified public IPs. This ensures access decisions are based on reliable, globally unique addresses, reducing the attacker's ability to bypass restrictions and providing visibility into this setting.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Entra ID
Themes
Tenant-wide
Attack Tactics
Defense Evasion Initial Access Persistence
Defend Tactics
D3-NI (Network Isolation)
Indicator Types
IOE
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical