A hands-on Microsoft lab demonstrating location-based access restrictions, MFA enforcement and session reauthentication controls.
Lab environment: This project was completed independently in a personal Microsoft lab. All identities, devices and configuration details are lab data.
| Area | Implementation |
|---|---|
| Business requirement | Reduce access risk from unexpected locations and long-lived sessions |
| Identity platform | Microsoft Entra ID |
| Location control | Australia trusted-region scenario |
| Session control | One-hour sign-in frequency |
| Validation | VPN testing and Entra sign-in logs |
A valid account can still present risk when used from an unexpected location or through a long-running session. This project tested how Conditional Access could apply location, MFA and sign-in-frequency controls.
- Created a named location representing the trusted-region scenario
- Configured a Conditional Access policy to block sign-ins outside Australia
- Used a VPN with a US endpoint to simulate external access
- Correlated the VPN address with Entra sign-in logs
- Required MFA as a grant control
- Configured a one-hour sign-in frequency
- Tested reauthentication after the configured interval
- Reviewed policy evaluation and authentication timestamps
| Test | Expected result | Observed result |
|---|---|---|
| Sign in from Australia scenario | Location condition permits policy progression | Allowed after required controls |
| Sign in through US VPN endpoint | Location policy blocks access | Access blocked |
| Continue session beyond configured frequency | User must authenticate again | Reauthentication required |
| Review sign-in logs | Location and policy decisions are recorded | Results confirmed |
The lab validated that Entra Conditional Access could block the simulated overseas sign-in, require MFA and enforce periodic reauthentication through session controls.
- Microsoft Entra ID
- Conditional Access
- Named locations
- MFA
- Sign-in frequency
- Session controls
- VPN-based testing
- Sign-in log analysis
View the full technical documentation (PDF)