How to configure "Europe Access Only" for resources in Azure Subscription instead of Tenant

Question

Our objective is to restrict access to resources within our Azure subscription to ensure that personal data remains inaccessible to operators and end-users located outside the EEA (European Economic Area) or Switzerland. Could you please share any clear guidelines or best practices that could aid in achieving this?
In the ticket https://learn.microsoft.com/en-us/answers/questions/2135995/how-to-configure-europe-access-only-for-resources?page=1#answer-1892976, we get answer about creating a Conditional Access policy in Microsoft Entra ID. But the Entra ID solution is based on Tenant level.

Our Tenant is a shared Tenant and there are some Subscriptions. Is there any solution based on Subscription?

Answer 1

Hi,

You can use RBAC, using a dynamic group based on location for example.

https://learn.microsoft.com/en-us/entra/identity/users/groups-create-rule

https://learn.microsoft.com/en-us/azure/role-based-access-control/overview

You can use Network Rules for Geographic Filtering by blocking IPs with the NSG.

https://learn.microsoft.com/en-us/azure/virtual-network/manage-network-security-group?tabs=network-security-group-portal#work-with-security-rules

You can use Azure Policy :

https://learn.microsoft.com/en-us/azure/governance/policy/overview

Sincerely,