How to restrict Workday access to a specific IP address using Conditional Access

This guide details how to configure Microsoft Entra ID Conditional Access to restrict Workday access to approved IP addresses: create Named Locations for trusted IPs, build a policy that blocks access from other locations (with exclusions for break-glass and integration accounts), validate in Report-only mode using sign-in logs and the What If tool, then enable the policy. It also lists prerequisites (licenses, SSO configured in Workday, static IPs, disabling local Workday logins) and emphasizes careful testing to avoid locking out users.