IP-Based Access Restriction Topology Using Microsoft Entra ID Conditional Access Policies

Overview

This article explains how to configure two Microsoft Entra ID Conditional Access Policies (CAPs) to secure Timus SSO authentication and restrict Microsoft 365 or other cloud applications to authorized Timus Gateway public IP addresses.

CAP 1: Enforce MFA for Timus SSO without IP restrictions.
CAP 2: Restrict protected cloud applications to Timus Gateway public IP addresses.

Why two policies? Users authenticate to Timus using their local public IP before the VPN connection is established. Applying IP restrictions to Timus SSO may prevent users from connecting.

1. Prerequisites

Timus Connect with Microsoft Entra ID SSO configured.
Microsoft Entra ID P1/P2 licensing and Conditional Access administration permissions.
A Timus Gateway with a static public egress IP.
An emergency access account excluded from restrictive policies.

2. CAP 1 – Enforce MFA for Timus SSO

Sign in to Microsoft Entra Admin Center.
Navigate to Entra ID → Conditional Access → Policies → New policy.
Configure the following:

Setting	Configuration
Policy Name	Timus – Enforce MFA
Users – Include	All users or selected groups
Users – Exclude	Emergency access accounts
Target Resources – Include	Timus Enterprise Application
Network	Not configured
Grant	Grant access → Require multifactor authentication
Policy Status	On (after validation)

Select Create.

Expected Result: Users can authenticate to Timus from any public IP address after completing MFA.

Important: Ensure existing Conditional Access policies do not independently block Timus authentication.

3. Find Your Timus Gateway Public IP

Sign in to Timus Manager.
Navigate to Gateway → Sites.
Locate your Gateway and click the three-dot menu (⋮).
Select Details.
Find the Public IP field in the upper-right corner.
Copy the IP address.

Path: Timus Manager → Gateway → Sites → ⋮ → Details → Public IP

Repeat for additional Gateways if applicable.

Note: Confirm that the displayed Gateway IP matches the actual public egress IP detected in Microsoft Entra sign-in logs.

4. Create a Trusted Network in Microsoft Entra ID

Navigate to Entra ID → Conditional Access → Named locations.
Select New location → IP ranges location.
Configure the following:

Setting	Configuration
Name	Timus Gateway – Trusted Network
IP Ranges	Timus Gateway public IP(s), e.g., `X.X.X.X/32`
Mark as trusted location	Enabled

Select Create.

Include all authorized Gateway egress IP addresses if multiple Gateways are used.

5. CAP 2 – Restrict Cloud Application Access to Timus Gateway IPs

Navigate to Entra ID → Conditional Access → Policies → New policy.
Configure the following:

Setting	Configuration
Policy Name	Timus – IP-Based Access Restriction
Users – Include	All users or selected groups
Users – Exclude	Emergency access accounts
Target Resources – Include	Select resources → Office 365 and other required applications
Target Resources – Exclude	Timus Enterprise Application, if included in the broader selection
Network – Include	Any network or location
Network – Exclude	Select networks and locations → Timus Gateway – Trusted Network
Grant	Block access
Policy Status	On (after validation)

Select Create.

Expected Result: Access to protected applications is blocked when authentication originates outside the authorized Timus Gateway public IP addresses.

Important: Using Select resources is recommended for this topology. If you use All resources with a Timus application exclusion, Microsoft Entra ID may still enforce the policy on certain baseline authentication scopes. Validate Timus SSO carefully to avoid authentication failures.

6. Verify Split Tunnel Configuration

For IP restrictions to work correctly, traffic to protected applications must exit through the Timus Gateway.

Navigate to Timus Manager → Agent Configuration → Tunnel Configuration and review the applicable routing rules.

Tunnel Configuration	Behavior
Split Tunnel – Through VPN	Routes matching traffic through Timus Gateway
Split Tunnel – Through Internet	Bypasses Timus and uses the user's local ISP IP

Example: If Microsoft 365 is restricted to your Timus Gateway IP but its authentication traffic is configured as Through Internet, Microsoft Entra ID may detect the user's local public IP and block access even while Timus Connect is connected.

Recommendation: Use Full Tunnel, or ensure all required authentication and application endpoints for protected services are routed Through VPN.

7. Test and Enable Both Policies

Initially configure both policies in Report-only mode, then validate these scenarios:

Test Scenario	Expected Result
Timus SSO from an external network	MFA required; authentication succeeds
Microsoft 365 through Timus Gateway	Allowed by IP restriction policy
Microsoft 365 without Timus VPN	Blocked from untrusted IPs
Microsoft 365 routed Through Internet	Blocked if the detected IP is untrusted
Emergency access account	Excluded from both policies

To verify results:

Navigate to Microsoft Entra ID → Monitoring & health → Sign-in logs.
Select a sign-in event.
Check the detected IP address, Resource, and Conditional Access results.
Confirm Timus SSO works without an established VPN connection.
Once all tests pass, set both policies to On.

Note: Existing Microsoft 365 sessions may remain active after VPN disconnection until Conditional Access is reevaluated. IP restrictions do not necessarily terminate active sessions immediately.

Summary

Policy	Purpose	Production Status
CAP 1 – Timus MFA	Secure Timus SSO without IP restrictions	On
CAP 2 – IP Restriction	Restrict protected applications to Timus Gateway public IPs	On

This configuration allows users to authenticate securely to Timus before connecting, while restricting protected cloud applications to authorized Gateway public IP addresses.

Updated November 09, 2026 13:28