What is location-based conditional access?

Last reviewed 20 October 2026

Location-based conditional access is an identity policy that allows, blocks or challenges a sign-in depending on where the user is, usually judged from their IP address and sometimes from their phone’s GPS.

How identity providers do it

Microsoft Entra is a common example. It says a user’s location “is determined using their public IP address or the GPS coordinates provided by the Microsoft Authenticator app” (Microsoft Entra documentation).

• By IP. Simple and invisible to the user. Microsoft notes that with a cloud proxy or VPN, “the IP address Microsoft Entra ID uses while evaluating a policy is the IP address of the proxy.”
• By GPS. “Every hour, the system contacts the user’s Microsoft Authenticator app to collect the GPS location of their mobile device.” After 24 hours the user must open the app and approve a notification. Microsoft advises it “should only be used to protect very sensitive apps where this behavior is acceptable.”

Where it falls short

• IP-based policies move with a VPN.
• GPS-based policies collect precise coordinates from the user’s phone every hour.
• Country codes depend on the platform: Microsoft notes one may report US for Puerto Rico while another reports PR.
• Neither produces a record that someone outside the identity provider can check.

Location as a signed factor

A stronger pattern sends a challenge to the user’s enrolled phone at sign-in. The phone answers whether it is inside the permitted region, signs that answer in secure hardware, and keeps the coordinates to itself. Octet’s LFA does this over OpenID Connect, so it works with identity providers that already accept an external factor. Policy can require a QR scan at each sign-in, which ties the phone’s answer to the computer being signed in.