Manage Entra ID Conditional Access policies and named locations via Graph API

Steps

1. Acquire a token with the Policy.ReadWrite.ConditionalAccess and Policy.Read.All application permissions (or the equivalent delegated permissions with a Conditional Access Administrator role).
2. Create or retrieve named locations: POST to /v1.0/identity/conditionalAccess/namedLocations with a body specifying @odata.type as either #microsoft.graph.ipNamedLocation (for IP ranges) or #microsoft.graph.countryNamedLocation, along with the displayName and the IP ranges or countries array.
3. Create a Conditional Access policy by POSTing to /v1.0/identity/conditionalAccess/policies with a ConditionalAccessPolicy body specifying displayName, state (enabled, disabled, or enabledForReportingButNotEnforced), conditions (users, applications, locations, platforms), and grantControls or sessionControls.
4. Reference named locations in the policy's conditions.locations.includeLocations or excludeLocations arrays using the named location object ID returned in the creation response.
5. Update an existing policy by PATCHing /v1.0/identity/conditionalAccess/policies/{policyId} with only the fields you want to change; set state to enabledForReportingButNotEnforced to test a policy in report-only mode before enforcement.
6. Audit policy changes by querying the Entra ID audit log via /v1.0/auditLogs/directoryAudits filtered by loggedByService eq 'Conditional Access' to track all modifications.