Restrict Microsoft 365 to your gateway IP

Microsoft 365 doesn't have a simple IP allowlist; the equivalent is an Entra ID Conditional Access policy that targets a named location. You define your Reach gateway IP as a trusted named location, then block (or require MFA for) sign-ins from any other network. Conditional Access requires Entra ID P1 (included in Microsoft 365 Business Premium, E3 and E5).

1. Create the named location

  1. Microsoft Entra admin center → Entra ID → Conditional Access → Named locations.
  2. + IP ranges location, name it TYO Reach gateway, add each gateway IP as 203.0.113.10/32, and tick Mark as trusted location. Save.

Trusted locations also improve Identity Protection's risk scoring for those sign-ins.

2. Create the policy

  1. Conditional Access → Policies → New policy.
  2. Users: the groups that should only sign in via Reach. Exclude a break-glass account.
  3. Target resources: All cloud apps (or just Exchange/SharePoint/Teams).
  4. Network (the condition formerly called Location): Configure → Yes, Include Any network or location, Exclude All trusted networks and locations.
  5. Grant: Block access.
  6. Start in Report-only mode, review the sign-in log for a day, then switch On.

Result: sign-ins from the Reach gateway IP are allowed; anything else is blocked once the token refreshes (within an hour for apps using modern authentication).

3. Route Microsoft 365 through Reach

Reach ships a Microsoft 365 preset in the organisation policy editor that routes the Microsoft sign-in and service domains through the gateway with one click — see Group policy. Apply it before switching the policy on, otherwise members will be blocked the moment their token refreshes on a home IP.

Common questions

Does Microsoft see the gateway IP or the user's home IP?

The gateway IP. Entra evaluates the public address the request comes from and ignores X-Forwarded-For, so the routed browser's exit IP is what the named location matches.

Can I require MFA instead of blocking?

Yes — set Grant → Require multifactor authentication with the same network condition. Sign-ins via Reach then pass silently; others get an MFA prompt.

Business Basic / Standard without P1?

Conditional Access isn't available. Security Defaults (MFA for everyone) is the fallback; IP-based restriction needs P1.

Source: Conditional Access: network signals and named locations