Created by Claude - please verify

Named locations - 'wide' is judged by CIDR prefix length only; confirm ownership of every trusted range.

Required Microsoft Graph permissions

Policy.Read.All — application permission, granted to the app registration with admin consent.

Licence: Microsoft Entra ID P1.

Endpoints: GET /v1.0/identity/conditionalAccess/namedLocations · GET /v1.0/identity/conditionalAccess/policies

Trusted locations also count as used when a policy targets 'All trusted locations'. IPv6 ranges are compared as if /32 were as broad as an IPv4 /16.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Named Locations & Trusted IP Audit

Conditional Access policies often skip MFA inside 'trusted' locations. A trusted range that is too wide - a /8, a whole cloud provider, 0.0.0.0/0 - quietly switches MFA off for anyone connecting from it. Locations no policy uses are clutter that hides the ones that matter.

This tenant has no named locations.