azure sign in logs incorrect geo location for business public IP addresses, how to update?

Question

Our entra user sign-in logs have the incorrect geo location for our corporate public IP addresses. They are correct in various geoip services / lookup databases on the internet. How do I get these correctly updated in Microsoft / Azure database?

Answer 1

I have the same issue for one of my clients in Africa and my own personal setup in the US. My client shows as an entirely different country and I show up as an entirely different state.

I find it unacceptable to have to enter a named location because Microsoft is giving bad data. That is a band aid solution rather than a fix.

If every geo ip locator site shows the right physical location of a public ip and MS doesn't, where is the problem and where should the resolution be?

Answer 2

Hello wsjake,

I’ve received an update from my PG team regarding this issue. The geo-location for IP addresses has been updated to the correct location. Please check with your end user and confirm if the issue is resolved.

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Answer 3

Hello @wsjake,

To update the geo location for your corporate public IP addresses in Microsoft Entra, you need to create or update named locations in the Microsoft Entra admin center. Here are the steps to do this:

1. Identify your public IP addresses: Work with your network administrators to identify the public-facing IPv4 or IPv6 addresses that represent your network.
2. Access the Microsoft Entra admin center: Sign in to the Microsoft Entra admin center as a Conditional Access Administrator.
3. Create or update named locations: Navigate to Entra ID > Conditional Access > Named locations. Here, you can create new named locations or update existing ones to include the identified IP addresses. This is crucial as users may be blocked if their sign-in IP addresses are not recognized as trusted locations.
4. Review Conditional Access policies: If you create new named locations, ensure that you update any relevant Conditional Access policies to include these new locations. If you add IPv6 ranges to existing named locations, no further changes are necessary for those policies.
5. Monitor sign-in logs: After making these updates, monitor the sign-in logs to check for any discrepancies in the IP addresses seen by Microsoft Entra ID and those seen by your resource providers. This can help you identify any further adjustments needed.

Configure strictly enforced location policies

---

If the Answer is helpful, please click Accept Answer and Up-Vote, so that it can help others in the community looking for help on similar topics.