How to Set Up and Manage Conditional Access Policies for Microsoft 365 to Block Logins from Outside Australia

Summary

This guide helps you troubleshoot and resolve: How to Set Up and Manage Conditional Access Policies for Microsoft 365 to Block Logins from Outside Australia. Follow the steps below to fix the issue.

Common Causes

Conditional Access policies allow your organisation to control how and where users can sign in to Microsoft 365. By restricting access to Australian IP addresses, you can significantly reduce the risk of unauthorised login attempts from overseas attackers targeting your Brisbane business accounts.

Detailed Instructions

Prerequisites

You need one of the following licences assigned to your users: Microsoft Entra ID P1, Microsoft Entra ID P2, Microsoft 365 Business Premium, or Microsoft 365 E3/E5. You must also sign in as a Global Administrator, Security Administrator, or Conditional Access Administrator.

Create the Conditional Access Policy

1. Open a web browser and go to https://entra.microsoft.com.
2. Sign in with your administrator account.
3. In the left-hand menu, select Protection, then select Conditional Access.
4. Click New policy.
5. In the Name field, enter Block sign-ins from outside Australia.

Assign Users and Cloud Apps

1. Under Assignments, select Users and workload identities.
2. Choose Select users and groups and add the users you want to protect. To protect everyone, select All users.
3. Click Done.
4. Select Cloud apps or actions.
5. Choose Select apps and search for Office 365 Exchange Online, Office 365 SharePoint Online, and Microsoft Teams. Alternatively, select All cloud apps to cover every Microsoft 365 service.
6. Click Select, then click Done.

Configure Location Conditions

1. Under Conditions, select Locations.
2. Set Configure to Yes.
3. Under Include, select Any location.
4. Under Exclude, select Selected locations.
5. Choose Countries and select Australia.
6. Click Select, then click Done.

Set Access Controls

1. Under Access controls, select Grant.
2. Select Block access.
3. Click Select.

Enable the Policy

1. Set Enable policy to Report-only initially.
2. Click Create.
3. Monitor the sign-in logs for at least 24 hours to ensure legitimate Australian users are not affected.
4. Return to the policy, select Edit, and change Enable policy to On.
5. Click Save.

Troubleshooting

Legitimate users are blocked while in Australia

Some Australian internet providers route traffic through overseas gateways, which can make a local connection appear to come from another country. If this happens:

• Review the Microsoft Entra sign-in logs to see the reported IP address and location.
• Contact your internet service provider to confirm where your public IP address is registered.
• Consider adding specific trusted IP ranges as named locations in Conditional Access instead of relying only on country blocking.

Users travelling overseas cannot sign in

This policy blocks sign-ins from outside Australia by design. If staff need to access Microsoft 365 while travelling internationally, create a separate Conditional Access policy that excludes those specific users from the block, or temporarily disable the policy for the duration of their trip.

Policy is not applying

• Ensure the affected users have the required licence (Microsoft Entra ID P1/P2 or Microsoft 365 Business Premium).
• Check that the policy is set to On, not Report-only.
• Wait up to 30 minutes after saving changes for the policy to propagate.

If you need assistance configuring or auditing your Conditional Access policies, Open a Ticket with our support team.

For help with account access issues, see our guide on Password reset (Windows login).

Still Having Issues?