ZTCA Configuration: Restrict Box access to trusted IPs using Entra Conditional Access

**Executive summary:** This guide describes how to restrict Box access to trusted IP addresses using Microsoft Entra ID Conditional Access by creating Named Locations, configuring a policy that blocks Box sign-ins from non-trusted IPs, validating in Report-only mode, and then enabling enforcement; it also covers prerequisites (licenses, SSO Required, disabling Security Defaults), validation tips, and operational cautions (exclude break‑glass admin, do not immediately enable without testing).