problem in Entra limit user account to local network logins

Question

problem in Entra limit user account to local network logins

IT 0

Not sure this is the correct forum, I need help in Entra.

We have a number of printers and copiers that scan. I created a user called 'scanner' to exclusively scan-to-email but I had to disable MFA for the scanner user to get it to work.

I tried Entra to limit the scanner account to logging in from the local network. I started a new policy, picked scanner as the user, set up the business location with the WAN IP and mask, granted access with 0 controls, and am ready to save. I see a message at the bottom of the screen:

It looks like you're about to manage your organization's security configurations. That's great! You must first disable security defaults before enabling a Conditional Access policy.

I definitely do NOT want to disable security defaults! Is there another way to tell Entra, "Allow the scanner user to log in only from the local networks' WAN address"?

Rob

VEMULA SRISAI 13,985 Reputation points Microsoft External Staff Moderator

2026-01-19T20:10:11.75+00:00
Hello IT,

This behavior is by design. Security Defaults and Conditional Access cannot be used together. Security Defaults enforce a fixed security baseline (including MFA for all users) and do not support exceptions for individual accounts. That is why Microsoft Entra prompts you to disable Security Defaults before allowing the creation of any Conditional Access policy.

To restrict a scanner account so it can sign in only from a specific WAN/IP address, Conditional Access is required. That means you would need to:

Disable Security Defaults

Have Microsoft Entra ID Premium P1/P2 or Microsoft 365 Business Premium

Create a Conditional Access policy that:

Targets only the scanner account

Uses a Named Location with your WAN IP

Allows sign-in only from that location (and optionally excludes MFA)

With Security Defaults enabled, there is no supported way to apply IP- or location-based access restrictions to a single user account.

For scan-to-email scenarios, Microsoft generally recommends avoiding interactive user sign-ins altogether. Supported alternatives that allow you to keep Security Defaults enabled include:

Using SMTP AUTH with a dedicated mailbox and restricting access at the network/firewall level

Using Microsoft High Volume Email (HVE) for printers and scanners

These approaches avoid MFA and Conditional Access

For Reference:

https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults

https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission
VEMULA SRISAI 13,985 Reputation points Microsoft External Staff Moderator

2026-01-20T18:23:52.79+00:00

IT Just checking in did you get a chance to review my previous comment regarding Security Defaults and Conditional Access? Let me know if you need further clarification or need further assistance.

Your answer

VEMULA SRISAI 13,985 Reputation points Microsoft External Staff Moderator

2026-01-19T20:10:11.75+00:00

Hello IT,

This behavior is by design. Security Defaults and Conditional Access cannot be used together. Security Defaults enforce a fixed security baseline (including MFA for all users) and do not support exceptions for individual accounts. That is why Microsoft Entra prompts you to disable Security Defaults before allowing the creation of any Conditional Access policy.

To restrict a scanner account so it can sign in only from a specific WAN/IP address, Conditional Access is required. That means you would need to:

Disable Security Defaults

Have Microsoft Entra ID Premium P1/P2 or Microsoft 365 Business Premium

Create a Conditional Access policy that:

Targets only the scanner account

Uses a Named Location with your WAN IP

Allows sign-in only from that location (and optionally excludes MFA)

With Security Defaults enabled, there is no supported way to apply IP- or location-based access restrictions to a single user account.

For scan-to-email scenarios, Microsoft generally recommends avoiding interactive user sign-ins altogether. Supported alternatives that allow you to keep Security Defaults enabled include:

Using SMTP AUTH with a dedicated mailbox and restricting access at the network/firewall level

Using Microsoft High Volume Email (HVE) for printers and scanners

These approaches avoid MFA and Conditional Access

For Reference:

https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults

https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission
VEMULA SRISAI 13,985 Reputation points Microsoft External Staff Moderator

2026-01-20T18:23:52.79+00:00

IT Just checking in did you get a chance to review my previous comment regarding Security Defaults and Conditional Access? Let me know if you need further clarification or need further assistance.