Question
A company uses a canvas app to manage production resources in a specific region. Employees must be at company locations to use the app.
Due to a sudden requirement for employees to work remotely, employees no longer commute to a specific location to conduct their work and cannot access the canvas app.
You must reconfigure the app to ensure that employees only access the app from a limited number of locations.
You need to restrict access to the app.
Which components should you configure? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Explanation
Ensure that employees can only access the app form a specific region: Azure Active Directory — Location- and network-based access restrictions for Power Apps are enforced by the identity provider, so you configure them in Azure Active Directory (Microsoft Entra ID), where named locations (IP ranges and countries/regions) are defined and evaluated at sign-in. Canvas app settings and the Power Platform admin center control app behavior, sharing, and environment/DLP governance but have no mechanism to restrict sign-in by geography, and the Office 365 admin center only manages users, licenses, and service settings.
Specify the locations where a user can access the app: Conditional Access policy — A Conditional Access policy targeting the Power Apps/Dataverse service applies the named locations as a condition, granting or blocking access depending on where the user signs in from, which is exactly the "only from a limited number of locations" requirement. A security role only controls privileges on Dataverse tables and records once the user is already authenticated, a Local Security policy applies to an individual Windows machine rather than cloud sign-ins, and a compliance policy in Intune evaluates device health and settings, not the user's location.
