Azure log shows user logon from Russia and Authentication detail showed user approved.

brichardi 361 Reputation points
2025-01-23T15:01:15.5766667+00:00

Hello everyone,

While checking Azure Identity Risky user, I came across an account that showed:

Logon location: Zelenograd, Moskva, RU

IP: 188.130.143.116

Device info: Operating System Ios 17.1.2

Authentication Result: User approved.

Can anyone help me understand why an IOS device located in US having RU IP address, and suceesfully logon when we have Conditional Access policy block signin outside of US.

Thanks for your help.

Microsoft Security | Microsoft Entra | Microsoft Entra ID
Microsoft Security | Microsoft Identity Manager
Microsoft Security | Microsoft Entra | Other
{count} votes

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.