Microsoft IP Geolocation

Question

Hello,

Microsoft’s IP geolocation seems to be incorrectly marking one of my subnets as MU, when it resides in ZA. I’ve checked my login activity logs and that’s where I’ve seen this.

Checking public IP geolocation DBs, and I can confirm they are correct.

How does this get resolved? I’ve submitted corrections to Bing Maps, but it’s still problematic.

Answer 1

Hello @Matthew Burnett,

As confirmed over private message, you were able to see the IP address with correct location at your end. Feel free to reach out to me if you face similar issues in future.

Answer 2

Microsoft services use internal geolocation data sources that are independent from public IP geolocation databases. When an IP range or subnet is misclassified (for example, shown as MU instead of ZA), this is an internal data issue that can only be corrected by Microsoft.

The available context describes how Microsoft services generally handle IP addresses and geolocation (for example, Application Insights and Sentinel enrichment APIs), but it does not provide a self-service way to correct Microsoft’s internal IP-to-geo mappings. The correction path is therefore:

1. Collect evidence
   • Public IP of the subnet and CIDR range.
   • Current incorrect region shown in Microsoft sign-in or activity logs.
   • Correct region (ZA) as confirmed by public geolocation providers.
2. Open a support case with Microsoft
   • Use the Microsoft 365 admin center (for a tenant-wide issue) or Azure support if the IP range is associated with Azure resources.
   • Provide the IP range, incorrect region (MU), and correct region (ZA), plus screenshots/log excerpts showing the misclassification.
   • Request that the IP range be reclassified in Microsoft’s internal geolocation data.
3. Wait for backend data refresh
   • Once Microsoft updates the internal IP geolocation, the change will propagate to sign-in logs and other telemetry over time. There is no client-side or tenant-side configuration to override the geo shown in those logs.

Submitting corrections to Bing Maps alone is not sufficient, because security and telemetry systems (such as sign-in logs, Azure Monitor, and Sentinel) rely on separate backend geolocation data and not only on Bing Maps.

---

References:

• Geolocation and IP address handling
• Enrich entities in Microsoft Sentinel with geolocation data via REST API (Public preview)