How to create a conditional access named location using Microsoft Graph PowerShell

The New-MgIdentityConditionalAccessNamedLocation cmdlet is used to create named locations in Microsoft Entra ID (formerly Azure AD), which can then be referenced in conditional access policies. Named locations help admins define trusted IP ranges, country locations, or specific network boundaries from which users are allowed or restricted from signing in. By creating these trusted locations, you can strengthen security by enforcing policies. Examples include requiring multi-factor authentication when users sign in from outside corporate networks or blocking access from high-risk geographic regions.

This article shows you how to create a conditional access named location using both Microsoft Entra admin center and Microsoft Graph PowerShell:

Create a named location using Microsoft Graph PowerShell

Prerequisites

You need the policy write permissions and the Graph module installed:

Using the New-MgIdentityConditionalAccessNamedLocation cmdlet

Run the script below by specifying the name and IP ranges or countries:

Examples

Example 1: Create named location with IP range

Example 2: Create named location for country

Example 3: Create location with multiple IP ranges

Supported parameters

The following essential parameters can be used along with the New-MgIdentityConditionalAccessNamedLocation cmdlet:

Limitations of using native tools to create conditional access named locations

• PowerShell commands can get complex with different use cases and scenarios.
• IT admins can spend a lot of time troubleshooting errors, which negatively impacts productivity.
• Delegation can get tricky since technicians require elevated permissions.