Hey guys looking for suggestions.

Our users connect in via VPN, authentication with their Entra account and then mfa using Duo.

They also have their own mobile devices which they access email / OneDrive / SharePoint etc on - we lock these down with app protection policies so they can't screenshot / copy data out etc.

Business wants to prevent people connecting and spoofing their location, using commercial vpn's like Nord.

I've tried using defender for cloud apps, but on my first attempt using Proton VPN, it did not tag the IP as an anonymiser / VPN, so the solution doesn't give me much hope.

I can sign up to a service that gives us commercial VPN ranges, and add those to named locations in Entra, but the limit is 2000 addresses, which isn't feasible. Plus the addresses change all the time.

Anybody got any other suggestions?

Hello my fellow Identity people! The r/ActiveDirectory community has a couple of events coming up, and you're welcome at both.

But wait, this is the Entra subreddit!

I am a firm believer that AD and Entra should be spoken of in the same sentence. Hybrid is the future. Hybrid is the path forward. So rather than fighting each other, let's work together.

Our meetups try to keep it to as little sales and marketing as possible (right now zero). It's just identity people doing identity things.

Tomorrow: Open Q&A

No agenda and no registration. Bring a question or just listen in.

When: October 16, 2026 @ 10:00 CT (UTC-5) / 15:00 UTC - 60 minutes

Where: Horizon Secured Discord - https://discord.gg/mVFquFqpsW

November Active Directory Community Virtual Meetup - November 3rd

A more structured session: panelists, a few prepared discussion topics, and open Q&A.

When: Tuesday, November 3, 2026 @ 10:00 CT (UTC-6) / 16:00 UTC - 90 minutes

Register (free): https://events.humanitix.com/active-directory-community-virtual-meetup-4-november-2026

Both get recorded and posted to YouTube afterwards if you can't make it live: https://youtube.com/@ActiveDirectoryCommunity