How to configure "Europe Access Only" for resources in Azure Subscription instead of Tenant

Bai, Bob 20

Our objective is to restrict access to resources within our Azure subscription to ensure that personal data remains inaccessible to operators and end-users located outside the EEA (European Economic Area) or Switzerland. Could you please share any clear guidelines or best practices that could aid in achieving this?
In the ticket https://learn.microsoft.com/en-us/answers/questions/2135995/how-to-configure-europe-access-only-for-resources?page=1#answer-1892976, we get answer about creating a Conditional Access policy in Microsoft Entra ID. But the Entra ID solution is based on Tenant level.

Our Tenant is a shared Tenant and there are some Subscriptions. Is there any solution based on Subscription?

Bai, Bob 20 Reputation points

2025-01-07T06:54:40.6733333+00:00
Thank you very much!

For operator who directly access Azure, we can use RBAC. But for the end users of Azure resource(such as a web App), how can we control the EU-only access? I'm not sure the requirement is exactly but a liiltle like EU Data Boundary https://learn.microsoft.com/en-us/privacy/eudb/eu-data-boundary-configure-azure-nonregional-services

For NSG and Azure Policy, we don't know which IP addresses belong to Europe and how to configure them.

Our Azure Subscription has many different resources such as App Service, Storage Accounts, Virtual machine, Virtual Network and disk. Need we configure the resources one by one or is there any solution at Subscription level?

Could you give us an example about the detail steps of the configuration? For example, we have an Azure Web App service which can read/write customer data in Disk. How can we restrict only Europe users can visit the Azure App Web page?

1 answer

Anthony LAVABRE 1,465 Reputation points

2025-01-06T17:29:01.3933333+00:00

Hi,

You can use RBAC, using a dynamic group based on location for example.

https://learn.microsoft.com/en-us/entra/identity/users/groups-create-rule

https://learn.microsoft.com/en-us/azure/role-based-access-control/overview

You can use Network Rules for Geographic Filtering by blocking IPs with the NSG.

https://learn.microsoft.com/en-us/azure/virtual-network/manage-network-security-group?tabs=network-security-group-portal#work-with-security-rules

You can use Azure Policy :

https://learn.microsoft.com/en-us/azure/governance/policy/overview

Sincerely,
Please sign in to rate this answer.
Bai, Bob 20 Reputation points

2025-01-07T07:18:29.7733333+00:00

Thank you!

Sakshi Devkante 925 Reputation points Microsoft Vendor

2025-02-18T10:28:29.04+00:00

Hello Bob,

I am following up to see if the suggestion provided by Anthony LAVABRE above was helpful to you. If you have any further questions or need additional assistance, please don’t hesitate to reach out.

Sakshi Devkante 925 Reputation points Microsoft Vendor

2025-02-19T10:30:47.6966667+00:00

Hello Bob,

I am following up to see if the suggestion provided by Anthony LAVABRE above was helpful to you. If you have any further questions or need additional assistance, please don’t hesitate to reach out.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to configure "Europe Access Only" for resources in Azure Subscription instead of Tenant

1 answer

Your answer