This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
I have multiple users getting logon message alerts sent to me that they logon from Tanzania all with AT&T phone equipment. Technical staff tell me it is a false positive due to AT&T IP6 issues. Is this true? Should I be concerned?
The user performed an impossible travel activity. The user was active from 73.192.213.22 in United States and 2600:387:5:807::9f in Tanzania within 718 minutes.
Another thread with the same symptoms: https://learn.microsoft.com/en-us/answers/questions/548596/ip6-on-atampt-causing-impossible-travel-alerts-fro.html
Sounds like it could be an IPv4 to 6 mapping issue with the carriers themselves or at the gateway where ISP traffic is routed to Microsoft.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(38.4, 36%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBW%3C/text%3E%3C/svg%3E)
We started seeing this last Thursday, we're getting Sprint, T-Mobile and Verizon IPv6 networks flagged as Tanzania. I posted this at @msftsecurity today via Twitter they replied that they know that this is an issue. I did report the issue as advised via the Microsoft Support Portal, the Microsoft Team quickly closed the raised ticket that there's no issues. So...not sure what's up.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(64, 40%, 16%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESC%3C/text%3E%3C/svg%3E)
Same here. Traffic, from all carriers, being routed through Tanzania. I checked the History and this has gone on since March, but we just started receiving the Alerts for Impossible Travel.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(195.2, 0%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVM%3C/text%3E%3C/svg%3E)
@John Rezek Thanks for reaching out.
If that is a network carrier issue, you cannot do much here, apart from raising it with them. Few things you would want to consider is making sure that the user is legitimate by confirming with user and removing false positive. Hope you already have MFA or password less configured on your tenant.
If after your investigation with AT&T , this turns out to be a real issue, to reduce the false positive , filter the logs only for successful logins. So that you can investigate the real entries from the huge noise that you might be getting.
-----------------------------------------------------------------------------------------------------------------
Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.
These are successful logins from the AT&T carrier and the reason for my concern. Thank you.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(284.8, 57.00000000000001%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETA%3C/text%3E%3C/svg%3E)
We are seeing this with Verizon also. I think this is an MS issue miss-classifying these IPs
@John Rezek @Texas Admin @Brian Williams the PG is aware about this and working in order to mitigate this. This has a dependency on third party where the work is going on already. Should be fixed soon.