Conditional Access policies can apply conditions based on where users sign in from. A named location defines such a place, for example a range of IP addresses or a set of countries or regions. In Nerdio Manager, you manage named locations in a dedicated page that works like the Named locations page in the Microsoft Entra admin center, instead of writing the definition of the location as JSON. You define a location once, at the MSP level, and the Conditional Access policies that use it apply it in every customer account where they are assigned.
The Named Locations page lets you create, edit, search, filter, and delete named locations, including locations that are defined by IP address ranges. The JSON editor remains available for people who prefer it. The page is intended for MSP administrators, and an account-level page lets administrators manage the named locations of a single customer.
The tasks in this article are performed at the MSP level and at the Account level.
The Named Locations page was introduced in Nerdio Manager v7.1. It replaces the Location Variables page and its JSON-based approach. The logic of the Conditional Access policies that use locations is unchanged.
|
Issue/limitation |
Impact |
Mitigation/planned fix |
|---|---|---|
|
The name of a named location is set when you create it. |
You cannot change the name when you edit the location. The name must be unique. |
Choose the name carefully, and create a new location if you need a different name. |
The following Nerdio Manager roles allow you to manage named locations:
-
Super Admin can manage named locations at the MSP level. At the Account level, Super Admin, MSP Admin, and Account Admin have full access to the account modules. Adding, editing, and deleting a named location use the same permissions as Conditional Access policies: creating a location needs the permission to create policies, and editing or deleting needs the permission to update them.
Following the Principle of Least Privilege (PoLP), you can define one or more Nerdio Manager custom role(s) with the access levels that apply to Conditional Access policies.
To open the Named Locations page:
-
At the MSP level, expand Policies, and then select Entra > Named Locations.
-
To find a location, search by name, or filter the table by location type.
At the Account level, the same page lists the named locations of the account.
To create a named location:
-
On the Named Locations page, select the button to add a location.
-
In Name, enter a name. The name must follow the naming rules, and it must not be used by another location.
-
Define the location. For an IP-based location, add the IP address ranges in the table, in the same way as in the Microsoft Entra admin center. For a location that is based on countries or regions, select them.
-
Select Save.
To edit or delete a named location:
-
On the Named Locations page, locate the location.
-
To change it, select the edit action, change the definition, and save. The name is read-only.
-
To remove it, select the delete action, and confirm.
A Conditional Access policy that you import into Nerdio Manager refers to a named location by its reference. In the table, copy the reference of a location and use it where the policy refers to a location. Because the reference points to the central location, a change that you make to the location applies to every customer where the policy is assigned and not overridden.
For a worked example that blocks sign-ins from high-risk countries across customers, see How can I use policy and variable overrides to block access from specific geographies for individual accounts?.
Contact our Sales team for more information about this feature.
Raise a support ticket about this feature.
Comments (0 comments)