Every location carries a security level. Set the threshold here (Settings → Security & two-factor) and any location at or stricter than it will refuse a photo, reading, or signature captured without a live location fix from the device — so evidence for your most sensitive rooms can't be recorded from somewhere else.
The default catches only Restricted locations, which is deliberately narrow: turning this up firm-wide means a technician with a weak signal indoors can get stuck, so most firms raise it project by project as the site actually requires it, not everywhere at once.
This is a different screen from Security events, which watches for failed logins and denied scans rather than where a photo was taken. Both sit under Security in Settings because both protect the record — from a different direction.