Exchange 2016 geolocation

Question

Is there a way to see the geolocation of where users are signing on from? It would be helpful alert to see if an account has been compromised. A suspicious user would probably be logging on from somewhere outside of our operating area. This is for premise/server based exchange not office365 or other cloud exchange solutions.

Answer 1

You'll really need to leverage Azure AD to do this:

https://learn.microsoft.com/en-us/microsoft-365/enterprise/hybrid-modern-auth-overview?view=o365-worldwide

There is no really good on-prem solutions other than some other 3rd party product perhaps or you would have to create your own processes to check logs and match them to country location.

Answer 2

Hi @will smith ,
I agree with what Andy said.
According to my research, we could know the IP address of the client login through the IIS log, but the on-premiese Exchange itself cannot be set to check for remote login and issue a warning.

In addition, I found two ways to restrict mailbox login, if it meets your needs, you can try to set:
1.You can restrict specific mailboxes to only log in on specified computers. But it should be noted that, according to my test, if this setting is made, the specific mailbox will not be able to log in through OWA, and can only be logged in to the Outlook client on the designated computer. Please refer to the settings in the screenshot below to set up in ADUC.

2.We can use the IP Address and Domain Restrictions function in IIS to restrict the mailbox to only log in to a specific IP or a specified IP range.

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

Thank you for the answers. I wish it let me accept both answers but it does not. Thanks again for the help and pointers.