Conditional Access Policy Name Location

Question

Conditional Access Policy Name Location

Handian Sudianto 6,096

Hello,

I have conditional access policy to allowing some users only can access from Indonesia only. This policy is working from long time ago. Now i have one user complain that he not able to access to the M365 from their home.

I can see in the log the user using ip address 182.25x.xx.xx and if i lookup on https://www.iplocation.net/ip-lookup the IP address 182.25x.xx.xx belong to Indonesia, but why Microsoft detect this ip from Singapore?

User's image

Raja Pothuraju 23,465 Reputation points Microsoft External Staff Moderator

2024-11-25T10:06:45.18+00:00
Hello @Handian Sudianto,

Thank you for posting your query on Microsoft Q&A.

Based on your description, it appears that you are experiencing an issue where the IP address 182.25x.xx.xx is incorrectly identified as being in Singapore in the Entra Sign-in logs. This mismatch is causing the Conditional Access policy to block access for a user signing in from Jakarta, Indonesia.

To address this issue, I will need to consult with my engineering team. However, I require some additional details from you:

Correlation ID:

Date/Timestamp:

Tenant ID:

IP Address: 182.25x.xx.xx

Correct Location: Jakarta, Indonesia

Incorrect Location: Singapore, Central Singapore

Please share one of the failure Correlation IDs, along with the corresponding Timestamp and Tenant ID.

As this information contains personally identifiable details, kindly send it via email to [AzCommunity@microsoft.com] with the subject line: Attn: Pothurajur. Include the following in the email body:

A link to this thread or post.

The requested information.

Once I receive the necessary details, I will escalate the issue internally to the engineering team for investigation and resolution regarding the geo-location of IP address 182.25x.xx.xx.

Thanks,
Raja Pothuraju.
Handian Sudianto 6,096 Reputation points

2024-11-25T23:21:48.37+00:00

hi @Raja Pothuraju

Mail sent....
Raja Pothuraju 23,465 Reputation points Microsoft External Staff Moderator

2024-11-26T01:20:26.7066667+00:00

Hello @Handian Sudianto,

Received your email. I'll share an update once Geo-location mapped to correct location.
Raja Pothuraju 23,465 Reputation points Microsoft External Staff Moderator

2024-11-26T04:27:32.1633333+00:00

Hello @Handian Sudianto,

Marked all the IP address on this post as it contains PII related.
Handian Sudianto 6,096 Reputation points

2024-11-28T00:50:52.3466667+00:00

Hi @Raja Pothuraju

Geo located already updated? Also is the conditional access policy can't work for signing to windows? The user can't access to the M365 resources such as one drive, sharepoint etc, but the user still able to login to the workstation.
Raja Pothuraju 23,465 Reputation points Microsoft External Staff Moderator

2024-11-28T01:35:45.2466667+00:00

Hello @Handian Sudianto,

I have reached out to the concerned team regarding this issue. It will take at least 48 hours, and depending on the location, it could take up to 14 days for the new data to be visible in Microsoft Entra ID. I noticed that an IP mismatch is causing the issue for the range 182.253.48.01–182.253.48.255. All these addresses need to be updated. Once the updated geo-location rollout is released, I will share an update with you.

In the meantime, as a workaround, you can modify your conditional access policy to allow user access.

Please note that conditional access policies do not apply to "Windows sign-ins".

Thanks,
Raja Pothuraju.

Accepted answer

1 additional answer

Your answer

Raja Pothuraju 23,465 Reputation points Microsoft External Staff Moderator

2024-11-25T10:06:45.18+00:00

Hello @Handian Sudianto,

Thank you for posting your query on Microsoft Q&A.

Based on your description, it appears that you are experiencing an issue where the IP address 182.25x.xx.xx is incorrectly identified as being in Singapore in the Entra Sign-in logs. This mismatch is causing the Conditional Access policy to block access for a user signing in from Jakarta, Indonesia.

To address this issue, I will need to consult with my engineering team. However, I require some additional details from you:

Correlation ID:

Date/Timestamp:

Tenant ID:

IP Address: 182.25x.xx.xx

Correct Location: Jakarta, Indonesia

Incorrect Location: Singapore, Central Singapore

Please share one of the failure Correlation IDs, along with the corresponding Timestamp and Tenant ID.

As this information contains personally identifiable details, kindly send it via email to [AzCommunity@microsoft.com] with the subject line: Attn: Pothurajur. Include the following in the email body:

A link to this thread or post.

The requested information.

Once I receive the necessary details, I will escalate the issue internally to the engineering team for investigation and resolution regarding the geo-location of IP address 182.25x.xx.xx.

Thanks,
Raja Pothuraju.
Handian Sudianto 6,096 Reputation points

2024-11-25T23:21:48.37+00:00

hi @Raja Pothuraju

Mail sent....
Raja Pothuraju 23,465 Reputation points Microsoft External Staff Moderator

2024-11-26T01:20:26.7066667+00:00

Hello @Handian Sudianto,

Received your email. I'll share an update once Geo-location mapped to correct location.
Raja Pothuraju 23,465 Reputation points Microsoft External Staff Moderator

2024-11-26T04:27:32.1633333+00:00

Hello @Handian Sudianto,

Marked all the IP address on this post as it contains PII related.
Handian Sudianto 6,096 Reputation points

2024-11-28T00:50:52.3466667+00:00

Hi @Raja Pothuraju

Geo located already updated? Also is the conditional access policy can't work for signing to windows? The user can't access to the M365 resources such as one drive, sharepoint etc, but the user still able to login to the workstation.
Raja Pothuraju 23,465 Reputation points Microsoft External Staff Moderator

2024-11-28T01:35:45.2466667+00:00

Hello @Handian Sudianto,

I have reached out to the concerned team regarding this issue. It will take at least 48 hours, and depending on the location, it could take up to 14 days for the new data to be visible in Microsoft Entra ID. I noticed that an IP mismatch is causing the issue for the range 182.253.48.01–182.253.48.255. All these addresses need to be updated. Once the updated geo-location rollout is released, I will share an update with you.

In the meantime, as a workaround, you can modify your conditional access policy to allow user access.

Please note that conditional access policies do not apply to "Windows sign-ins".

Thanks,
Raja Pothuraju.

Answer 1

Raja Pothuraju 23,465 Microsoft External Staff Moderator

Hello @Handian Sudianto,

Thank you for posting your query on Microsoft Q&A.

I’ve received an update from my PG team regarding this issue. The geo-location for IP addresses 182.253.48.01–182.253.48.255 has been updated to the correct location, Jakarta, Indonesia. Please check with your end user and confirm if the issue is resolved.

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Thanks,
Raja Pothuraju.

Handian Sudianto 6,096 Reputation points

2024-12-05T02:15:01.5166667+00:00

Hi @Raja Pothuraju

How we can test manually to check the IP is on correct location or not without see in the sign-in logs?

I can see today the IP still in singapore.
Raja Pothuraju 23,465 Reputation points Microsoft External Staff Moderator

2024-12-05T18:16:35.6633333+00:00

Hello @Handian Sudianto,

Thank you for sharing the update on the issue. We can confirm this only through the sign-in logs. Please check the sign-in logs tomorrow and verify if it still shows the Singapore location.

Thanks,
Raja Pothuraju.
Handian Sudianto 6,096 Reputation points

2024-12-06T06:29:02.3433333+00:00

hi @Raja Pothuraju

Seem the IP now is in correct location. Thanks for your help.

Answer 2

Abiola Akinbade 29,405 Volunteer Moderator

Hello Handian Sudianto,

Thanks for your question.

This may require creating a ticket or contacting Azure support as I also checked and saw the IP from biznet networks in IND. You might also need to contact the ISP to see if they can help.

As a temporary measure, maybe modify the Conditional Access policy to allow access from the specific IP address before support gets to it?

You can mark it 'Accept Answer' and 'Upvote' if this helped you

Regards,

Abiola

Share via

Conditional Access Policy Name Location

1 additional answer

Your answer