User login details information

Question

Hi All,

I am using Microsoft 365 E5 license. we create users in exchange onprem and migrate to exchange online.

From my understanding, during the initial setup of a Windows or macOS device, users are prompted to select their country or region.

I'm looking for a way to determine, using Active Directory or Microsoft Entra ID logs, the country or location from which users are signing in. Specifically:

• Is there a way to identify the country or location from which a user signed in?
• Is this information available in AD or Microsoft Entra ID sign-in logs?
• Can the country selected during device setup be retrieved or correlated with sign-in data?

Any guidance would be appreciated. Thank you.

Answer 1

Hello @Glenn Maxwell

Based on your description, there are two different pieces of information to consider:

The location where a user signs in

The country/region selected during the initial Windows or macOS setup

For sign-in location:

Microsoft Entra ID sign-in logs can show the country/region, city, and public IP address used during authentication. You can view this information in:

"Microsoft Entra admin center" > "Microsoft Entra ID" > "Monitoring & health" > "Sign-in logs"

Open a sign-in record and check the "Location" and "IP address" fields. The location is determined from the public IP address seen by Microsoft Entra ID.

Learn about the sign-in log activity details - Microsoft Entra ID | Microsoft Learn

For Active Directory on-premises:

Traditional AD security logs do not normally provide geographic location information. They record authentication events, but not country or city information derived from IP geolocation.

For the country selected during device setup:

In general, the country/region chosen during the Windows or macOS out-of-box experience is not stored in Microsoft Entra ID sign-in logs and cannot be directly correlated with user sign-in location data. Sign-in logs reflect the location associated with the authentication IP address, not the region selected when the device was first configured.

-

To make things easier, I followed the steps in Microsoft Entra ID on my side and took the screenshots below. You can use them as a reference while checking your environment.

For your reference:
Learn about the sign-in log activity details - Microsoft Entra ID | Microsoft Learn

Sign-in logs in Microsoft Entra ID - Microsoft Entra ID | Microsoft Learn

Kind regards,

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".  

Note: Please follow the steps in "our documentation" to enable e-mail notifications if you want to receive the related email notification for this thread.