How to find unused named locations in Microsoft Entra ID

Before you start

Use an account in one of these roles: Security Reader, Global Reader, Security Administrator or Conditional Access Administrator. Named locations are part of Conditional Access, which needs Microsoft Entra ID P1. The PowerShell example requests Policy.Read.All; your organisation may require administrator consent.

Know what counts as a use. The examples count a policy in any state, so a location named only by a report-only or off policy is in use. They look at Conditional Access policies only. They read and export; they don't change or delete any location.

Option 1

Find unused named locations with PowerShell

Install the modules once, then connect, read the locations and the policies, and export the locations no policy names.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.Identity.SignIns -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'Policy.Read.All' -NoWelcome
try {
    $locations = @(Get-MgIdentityConditionalAccessNamedLocation -All)
    $policies = @(Get-MgIdentityConditionalAccessPolicy -All)
    $named = @($policies | ForEach-Object {
        $_.Conditions.Locations.IncludeLocations
        $_.Conditions.Locations.ExcludeLocations
    })
    $report = @(foreach ($location in ($locations | Sort-Object DisplayName)) {
        $extra = $location.AdditionalProperties
        $type = $extra['@odata.type'] -replace '^#microsoft\.graph\.', ''
        $trusted = $type -eq 'ipNamedLocation' -and $extra['isTrusted'] -eq $true
        # A policy can name every trusted location at once with AllTrusted.
        $allTrusted = $trusted -and $named -contains 'AllTrusted'
        if ($allTrusted -or $named -contains $location.Id) { continue }
        [pscustomobject]@{
            Location = $location.DisplayName
            Type     = $type
            Trusted  = $trusted
            Created  = $location.CreatedDateTime
            Modified = $location.ModifiedDateTime
            Id       = $location.Id
        }
    })
    if ($report.Count -eq 0) {
        Write-Output "All $($locations.Count) named locations are used by a policy."
    } else {
        $report | Export-Csv -Path './unused-named-locations.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) of $($locations.Count) named locations are unused."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The script gathers every location ID the policies include or exclude, then keeps the locations not among them. Type is ipNamedLocation for IP ranges or countryNamedLocation for countries and regions; only an IP location can be trusted. To count only the policies that are on, add Where-Object { $_.State -eq 'enabled' } before the ForEach-Object that gathers the IDs.

Option 2

Check named locations in the admin centre

1. Sign in to the Microsoft Entra admin centre for the correct tenant.
2. Go to Entra ID > Conditional Access > Named locations and note each location.
3. Go to Entra ID > Conditional Access > Policies, open each policy and read the Network assignment, formerly Locations, for the locations it includes or excludes.
4. Leave each policy without saving. A location that no policy names, directly or as all trusted locations, is unused by policies.

This suits a tenant with a few policies. Matching every location against every policy manually is slow, so for more than a handful, use PowerShell or a report.

Common questions

Is an unused trusted location safe to delete?

Check first. Sign-ins from trusted named locations improve the accuracy of Microsoft Entra ID Protection's risk calculation, so a trusted location can matter with no policy naming it. Microsoft won't delete a trusted location until you remove its trusted mark, and a deleted location can be restored within 30 days.

Why isn't a location used only by a report-only policy on the list?

The script and Altivane count a policy in any state. A location named only by a policy that is report-only or off has no effect at sign-in yet. To list those policies, see how to find Conditional Access policies not enforced.

What are MFA Trusted IPs in the location list?

They are the trusted IPs from the legacy multifactor authentication service settings, not a named location, and they count as trusted locations in a policy. Microsoft doesn't recommend them, and they accept IPv4 addresses only.