ZTCA Configuration: Restrict Azure management sign-ins to trusted IPs using Entra Conditional Access

This article is a step-by-step guide for configuring Microsoft Entra Conditional Access to restrict Azure management-plane sign-ins (portal, CLI, PowerShell, ARM API) to specified Named Location IP addresses, including creating the named location, building a policy targeting the Windows Azure Service Management API, validating in Report-only mode, excluding break-glass and automation accounts, and enabling enforcement.