To control Multi-Factor Authentication (MFA) based on a user's physical location, such as a specific office, you must use the location condition within an Azure AD Conditional Access policy. Azure AD identifies a user's location by their source public IP address. The Named Locations feature allows you to define a trusted location, like the Boston office, by specifying its public IP address range(s). This named location can then be used in a Conditional Access policy to either require or bypass MFA for users connecting from that network, thereby meeting the specified requirements.

A. named locations that have a private IP address range: Azure AD is a cloud service and cannot see the internal private IP addresses (e.g., 10.0.0.0/8) of a corporate network; it only sees the public-facing IP.

C. trusted IPs that have a public IP address range: "Trusted IPs" is a legacy feature within the MFA service settings. While functional, the modern and recommended best practice is to use Named Locations with Conditional Access for more granular and flexible policy control.

D. trusted IPs that have a private IP address range: The legacy "Trusted IPs" feature, like Named Locations, operates on public IP addresses, as Azure AD has no visibility into an organization's internal private network ranges.

---

1. Microsoft Azure Documentation

"Use the location condition in a Conditional Access policy": This document explicitly states how to configure locations for use in Conditional Access. In the section "Configure IP address ranges location

" it clarifies

"You can mark IP address ranges that represent your organization's on-premises network in Azure AD as a named location... Private IP ranges cannot be specified." This supports using public IP ranges and directly refutes options involving private IPs.

Source: Microsoft Corporation. (2023). Use the location condition in a Conditional Access policy. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition#configure-ip-address-ranges-location

2. Microsoft Azure Documentation

"Configure Azure AD Multi-Factor Authentication settings": This document describes the "Trusted IPs" feature and its limitations. It notes

"If you're using Conditional Access

trusted IPs must be configured as a named location." This confirms that for modern policy-based control

Named Locations is the correct and integrated feature to use

making it superior to the legacy "Trusted IPs" option.

Source: Microsoft Corporation. (2023). Configure Azure AD Multi-Factor Authentication settings. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings#trusted-ips