Skip to content
TheCloud.Events

Update named location

Azure

Update named location

service: Azure - Conditional Access, Named Locations
tactics:
Defense Impairment
techniques:
T1556.009
tags:
Azure Conditional Access, Named Locations

Event

Updates a named location definition (IP ranges or countries) used in Entra ID Conditional Access policy conditions.

Security Context

  • Impairing defenses allows adversaries to operate freely by removing security controls that would otherwise detect or block their activity.

Log Source

Entra ID Audit Logs

Sample Event

Adversarial. draco@fantasticlogs.cloud modifies the trusted named location Corporate-Office-Egress (used by CA policies as a trusted-network condition) to add his external adversary IP 203.0.113.66/32 and mark the location as isTrusted = true. Future authentications from Draco’s IP will satisfy “trusted location” CA bypass conditions.

{
  "id": "Directory_90000000-0000-4000-8000-000100011111_2B4D8_82148710",
  "category": "Policy",
  "correlationId": "90000000-0000-4000-8000-000100011111",
  "result": "success",
  "resultReason": "",
  "activityDisplayName": "Update named location",
  "activityDateTime": "2026-04-15T18:18:23.7218042Z",
  "loggedByService": "Conditional Access",
  "operationType": "Update",
  "initiatedBy": {
    "app": null,
    "user": {
      "id": "30000000-0000-4000-8000-001010011010",
      "displayName": "Draco Malfoy",
      "userPrincipalName": "draco@fantasticlogs.cloud",
      "ipAddress": "203.0.113.66"
    }
  },
  "targetResources": [
    {
      "id": "60000000-0000-4000-8000-000011101101",
      "displayName": "Corporate-Office-Egress",
      "type": "Other",
      "userPrincipalName": null,
      "groupType": null,
      "modifiedProperties": [
        {
          "displayName": "ipRanges",
          "oldValue": "[{\"@odata.type\":\"#microsoft.graph.iPv4CidrRange\",\"cidrAddress\":\"198.51.100.0/24\"}]",
          "newValue": "[{\"@odata.type\":\"#microsoft.graph.iPv4CidrRange\",\"cidrAddress\":\"198.51.100.0/24\"},{\"@odata.type\":\"#microsoft.graph.iPv4CidrRange\",\"cidrAddress\":\"203.0.113.66/32\"}]"
        },
        {
          "displayName": "isTrusted",
          "oldValue": "[false]",
          "newValue": "[true]"
        },
        {
          "displayName": "Included Updated Properties",
          "oldValue": null,
          "newValue": "\"ipRanges\""
        }
      ]
    }
  ],
  "additionalDetails": [
    {
      "key": "User-Agent",
      "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"
    }
  ]
}

MITRE ATT&CK Mapping

Tactics: Defense Impairment

Techniques:
  • T1556.009 — Conditional Access Policies — Adversaries may disable or modify conditional access policies to enable persistent access to compromised accounts. Conditional access policies are additional verifications used by identity providers and identity and access management systems to determine whether a user should be granted access to...
shares T1556.009 — Conditional Access Policies
Update Conditional Access Policy