M365 Conditional Access Blocklist Builder (IP2ASN Combined)

1) Data sources

IP2ASN TSV

Expected format: start_ip, end_ip, asn, country, as_name, as_description (tab-separated).

Output format

Conditional Access named locations accept CIDR. "Start-End" is mainly for inspection or other tooling.

Block Outside of USA (country != US) Block Outside of North America (country not in US, CA, MX) Block TOR Exit Nodes

Block Known VPN Providers (match ISP/AS name) Block Datacenter Providers (match ISP/AS name) Skip "Not routed" / ASN 0 rows (recommended)

TOR list options

Auto-fetch TOR exits from dan.me.uk (if TOR box is checked)

If auto-fetch fails due to CORS, download the list manually and paste it below.

TOR exit nodes list (one IP per line)

These will be emitted as /32 (IPv4) or /128 (IPv6).

VPN and Datacenter match lists

VPN provider ASNs (one per line)

Matches against the ASN column in ip2asn-combined.tsv. Use numeric ASNs, one per line.

Datacenter provider ASNs (one per line)

Matches against the ASN column in ip2asn-combined.tsv. Use numeric ASNs, one per line.

Advanced output controls

Include IPv4 Include IPv6 Preview lines

This tool merges overlapping and adjacent ranges before CIDR conversion to reduce output size. Conditional Access has limits on how many IP ranges you can store, so massive outputs may need splitting across multiple named locations.

Download

Idle

1) Data sources

2) Output preview