How to Block Access from Countries Using Conditional Access Named Locations
Your organization uses Microsoft Entra Conditional Access. You need to block access from countries where your company does not operate. The list of blocked countries changes frequently. What is the most efficient way to manage this?
Quick Answer
The answer is to create Named Locations for blocked countries and use them in a Conditional Access policy. This is the most efficient method because Named Locations allow you to define country boundaries by IP ranges, and you can update the list of blocked countries directly within the Named Locations configuration without ever touching the Conditional Access policy itself—a critical advantage when the list changes frequently. On the MS-102 exam, this scenario tests your understanding of how to decouple policy logic from dynamic data; a common trap is to create a separate policy for each country, which is inefficient and hard to maintain. Instead, remember that Named Locations act as a centralized, reusable filter. Memory tip: think of Named Locations as a “dynamic blocklist” that you edit in one place, while the Conditional Access policy simply points to it—update the list, not the rule.
⚠ Common exam trap
Many candidates think using IP ranges directly in the policy (Option C) is more precise, but they overlook the administrative overhead of maintaining those ranges manually, whereas Named Locations with country selection provide a simpler and more scalable solution for frequently changing country lists.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create Named Locations for blocked countries and use them in Conditional Access
Named Locations in Microsoft Entra Conditional Access allow you to define countries by IP ranges and then use those locations in a policy to block access. This is the most efficient approach because you can update the list of blocked countries in the Named Locations configuration without modifying the Conditional Access policy itself, which is ideal when the list changes frequently.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Microsoft Entra multifactor authentication for all users from blocked countries
Why it's wrong here
MFA does not block access; it only adds verification.
- ✗
Create a Conditional Access policy that blocks all locations except the allowed countries
Why it's wrong here
This requires maintaining an allow list, which is inefficient if allowed countries change.
- ✗
Use IP ranges in Conditional Access to block specific country IPs
Why it's wrong here
IP ranges are static and not scalable for dynamic country blocking.
- ✓
Create Named Locations for blocked countries and use them in Conditional Access
Why this is correct
Named Locations can be easily updated with new countries.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Conditional Access policy
A Conditional Access policy is a set of rules in Microsoft Entra ID that automatically grants or blocks access to cloud apps based on signals like user identity, location, device health, and risk level.
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
About these practice questions
One of 241 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MS-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization needs to implement a Conditional Access policy that blocks access from countries where the company has no business operations. Which TWO conditions should you configure?
medium- A.Device platforms
- ✓ B.Locations
- C.User risk
- ✓ D.Client apps
- E.Sign-in risk
Why B: To block access from countries where the company has no business operations, you configure the Locations condition to define named locations based on IP ranges or countries. Additionally, you must configure the Client apps condition to specify which applications the policy applies to, such as all client apps or specific types like browser or mobile apps. This ensures the policy effectively blocks access from the specified countries across the intended applications.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.