EntraID mis-locates IP addresses during sign-in events, creating false positives.

Question

EntraID mis-locates IP addresses during sign-in events, creating false positives.

David Baxter 25

False positive security alerts are being triggered when users have unsuccessful sign-in events from trusted locations which are our branch locations, but Entra ID is logging them as coming from a completely different city, despite using the correct IP.

In our particular example, the public IP of one of our branches is in Texas, but the sign in logs show Portland, OR as the sign in location, despite showing the correct IP and recognizing it as a trusted location.

How do we resolve this so the IP addresses are represented by the right geographical location?

Vigneshwar Duvva 2,225 Reputation points Microsoft External Staff Moderator

2025-05-09T18:28:11.2833333+00:00

Hello @David Baxter

Based on your description, it appears that your geolocation is being reported incorrectly. To resolve this, we will need to involve our Product Group team for further investigation.

To proceed, I kindly ask that you share the following details via private message, as this information includes Personally Identifiable Information (PII):

IP Address:

Incorrect Location Displayed:

Correct Location:

Correlation ID:

Once we receive this information, we can connect offline to discuss the next steps and work towards a resolution.
Vigneshwar Duvva 2,225 Reputation points Microsoft External Staff Moderator

2025-05-13T09:17:15.7566667+00:00

Hello @David Baxter

I have submitted the details to our product group team, and they will resolve the issue from the backend. Once we receive an update, we will inform you accordingly.
Vigneshwar Duvva 2,225 Reputation points Microsoft External Staff Moderator

2025-05-16T01:58:57.03+00:00

Hello @David Baxter

We’ve received an update from our PG team, and the IP address now shows the correct location. Could you please check the sign-in logs to confirm if the correct location is being reflected?

Looking forward to your response.
Vigneshwar Duvva 2,225 Reputation points Microsoft External Staff Moderator

2025-05-19T02:23:14.8833333+00:00

Hello @David Baxter

Did you get a chance to review my previous comment. we received update from our PG team now the IP address shows the correct location.

Could you please confirm from your side by checking the sign-in logs.

1 answer

Your answer

Vigneshwar Duvva 2,225 Reputation points Microsoft External Staff Moderator

2025-05-09T18:28:11.2833333+00:00

Hello @David Baxter

Based on your description, it appears that your geolocation is being reported incorrectly. To resolve this, we will need to involve our Product Group team for further investigation.

To proceed, I kindly ask that you share the following details via private message, as this information includes Personally Identifiable Information (PII):

IP Address:

Incorrect Location Displayed:

Correct Location:

Correlation ID:

Once we receive this information, we can connect offline to discuss the next steps and work towards a resolution.
Vigneshwar Duvva 2,225 Reputation points Microsoft External Staff Moderator

2025-05-13T09:17:15.7566667+00:00

Hello @David Baxter

I have submitted the details to our product group team, and they will resolve the issue from the backend. Once we receive an update, we will inform you accordingly.
Vigneshwar Duvva 2,225 Reputation points Microsoft External Staff Moderator

2025-05-16T01:58:57.03+00:00

Hello @David Baxter

We’ve received an update from our PG team, and the IP address now shows the correct location. Could you please check the sign-in logs to confirm if the correct location is being reflected?

Looking forward to your response.
Vigneshwar Duvva 2,225 Reputation points Microsoft External Staff Moderator

2025-05-19T02:23:14.8833333+00:00

Hello @David Baxter

Did you get a chance to review my previous comment. we received update from our PG team now the IP address shows the correct location.

Could you please confirm from your side by checking the sign-in logs.

Answer 1

Vigneshwar Duvva 2,225 Microsoft External Staff Moderator

Hello @David Baxter

Thank you for sharing the required details via private message.

The issue was related to an IP location mismatch. We collected the necessary information from you and engaged our Product team to investigate further. They have now resolved the issue from the back end.

You should be able to see the correct location in the Azure portal for the affected IP addresses.

We hope this information is helpful. Please feel free to reach out if you have any further questions or need additional assistance

Share via

EntraID mis-locates IP addresses during sign-in events, creating false positives.

1 answer

Your answer