How to restrict Microsoft Azure access to specific IP addresses using Conditional Access

### Executive summary This guide describes how to restrict access to the Azure management plane (portal, CLI, PowerShell, ARM API) by creating Named Locations and a Conditional Access policy in Microsoft Entra ID that blocks access from any IP not in the trusted list; it covers prerequisites, step-by-step configuration, validation in Report-only mode, and the importance of a break-glass account to prevent accidental admin lockout.