Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Named locations control where a sign-in comes from; risk-based Conditional Access responds to how suspicious that sign-in appears. For travelers, use location rules to enforce geographic or network boundaries and sign-in risk to trigger an adaptive challenge or block. They are complementary controls: keep legitimate travel exceptions narrow and reviewable, and investigate unusual sign-ins rather than treating every travel alert as proof of compromise.
What named locations and sign-in risk actually measure
A named location is a Conditional Access location condition. It can represent public IPv4 or IPv6 ranges, countries or regions, areas that cannot be mapped to a country, or a Global Secure Access compliant network. A policy can include or exclude selected locations. Trusted IP locations can also improve Microsoft Entra ID Protection’s risk-calculation accuracy. See Microsoft’s network assignment guidance.
As an Amazon Associate I earn from qualifying purchases.
Sign-in risk is ID Protection’s assessment of the likelihood that a particular authentication request is not from the identity owner. A policy can use that assessment to allow access, require multifactor authentication (MFA), require reauthentication, or block access. User risk is different: it reflects the probability that the identity itself is compromised, rather than the risk assessment for one sign-in. Microsoft’s risk-based access policy documentation explains these distinctions.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →| Decision | Named locations | Risk-based Conditional Access |
|---|---|---|
| Signal | Public IP/network, geography, or compliant-network membership. Microsoft Learn | ID Protection sign-in or user risk signals. Microsoft Learn |
| Best fit | Enforcing known network boundaries, blocking disallowed countries, or applying different requirements on and off a trusted network. | Responding to suspicious sign-ins with an adaptive challenge, reauthentication, or block. |
| Travel effect | A traveler may be blocked because their observed location has changed. A controlled exception can accommodate legitimate travel. | Travel is context to assess alongside other detections; a travel anomaly may contribute to a risk-based response if the policy condition is met. |
| Operational dependency | Keep IP ranges and country selections accurate; account for IP mapping and unmapped areas. | Requires available ID Protection risk signals. The documented sign-in-risk MFA example requires Microsoft Entra ID P2. Microsoft Learn |
| Typical failure mode | Incorrect scope or an overly broad exception can block legitimate users or weaken a boundary. | Risk detections can be false positives or arrive after a sign-in; investigate and calibrate thresholds. |
Should you block sign-ins by country or use sign-in risk?
Choose a location rule when the requirement is a predictable boundary—for example, blocking access from countries where the organization does not operate, or requiring MFA whenever users are outside the corporate network. A location-based block is enforced after first-factor authentication, so it is not a pre-authentication defense. Microsoft’s location-block policy guide describes this use.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Use sign-in risk when the decision should depend on evidence that an authentication request may be unauthorized, rather than geography alone. A legitimate traveler can trigger a location rule simply by signing in from a new country; risk-based handling can consider whether the sign-in appears suspicious. Neither signal replaces investigating a security alert, and using both lets a tenant enforce boundaries while responding to detected risk.
How to let users sign in while traveling
If a blanket country block would deny legitimate business travel, Microsoft’s documented approach is to manage exclusions—for example, with a cloud security group used for the policy exclusion. Users may be able to add themselves through self-service group management. Make membership bounded, reviewable, and consistent with the organization’s approval and access-review practices; avoid converting a trip exception into a permanent, broad bypass. See Microsoft’s guidance on managing users excluded from Conditional Access policies.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Limit the exception to the people and policies that need it.
- Use the organization’s approval and review process for membership.
- Keep emergency access accounts protected from accidental lockout when designing exclusions and policy scope.
How to investigate an atypical travel sign-in
Do not conclude that an alert proves compromise just because the location is unusual. Microsoft’s investigation guidance recommends checking whether the user actually traveled to the reported destination, whether the IP is known for that user’s duties, and whether the address range belongs to a sanctioned VPN. If a VPN range is confirmed as sanctioned, it can be added to named locations. If the activity is not legitimate, Microsoft recommends marking the sign-in as compromised and invoking remediation. Follow Microsoft’s ID Protection investigation guidance.
Example: a risk-based MFA policy and its requirements
Microsoft’s documented example targets medium- and high-sign-in risk, requires MFA, and sets sign-in frequency to Every time. Microsoft describes that threshold as a recommendation that may not suit every organization. The example requires Microsoft Entra ID P2, and users must have a registered authentication method capable of satisfying MFA before they can satisfy an MFA risk policy. See the sign-in risk-based MFA policy guide.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Microsoft states that legacy ID Protection sign-in and user risk policies retired on October 1, 2026. As of October 4, 2026, administrators should verify whether their tenant still has legacy policies, check their status, and confirm replacement coverage in Conditional Access. The retirement information is in Microsoft’s ID Protection risk-based access policy documentation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to roll out location policies without avoidable lockouts
- Set the scope and location conditions. Check the users, apps, countries, IP ranges, and any exclusions that the policy will affect.
- Validate before enforcement. Use report-only mode and policy impact or What If validation to assess the effect of a restrictive location policy before turning it on.
- Protect emergency access. Exclude emergency access accounts from policies that could otherwise lock administrators out, while keeping those accounts appropriately secured.
- Account for session timing. A location change may not be reflected immediately in every app. Microsoft’s network guidance says modern-authentication mobile and desktop apps evaluate location during token acquisition or refresh, typically once an hour by default. Web checks occur at initial sign-in and when a new sign-in token is requested; session behavior varies by app. A user who changes networks mid-session may therefore not see the policy take effect at once.
For implementation details, consult Microsoft’s location-block policy guide and network assignment documentation.
Quick Recap
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
