ZTCA Configuration: Restrict GitHub Enterprise access to trusted IPs using Entra Conditional Access

This article provides step-by-step guidance to restrict GitHub Enterprise access by IP using Microsoft Entra ID Conditional Access: it lists prerequisites (licenses, SSO configuration, static IPs, break-glass accounts), shows how to create Named Locations, build a Conditional Access policy that blocks sign-ins from untrusted IPs (initially in Report-only), validate via sign-in logs and the What If tool, and finally enable enforcement; it also notes differences for OIDC/EMU and recommends configuring GitHub's native IP allow list for full coverage.