Incorrect Public IP Location on Microsoft Entra

Microsoft Entra determines location based on the public IP address seen during sign-in or by the resource, and that IP is then evaluated against Conditional Access named locations and country/region mappings. If the public IP’s geolocation is incorrect, Conditional Access policies that rely on location (IP ranges or countries/regions) can behave unexpectedly.

From the available information, the supported way to mitigate impact is to adjust Conditional Access configuration rather than directly changing the geolocation record:

1. Use sign-in logs to confirm the IP being evaluated
   • In the Microsoft Entra admin center, go to Entra ID > Monitoring & health > Sign-in logs.
   • Add the IP address (seen by resource) column and filter out blanks to see where the IP used for evaluation differs from the IP seen by Entra ID.
   • Use these logs to identify the exact public IP address (or range) that is being mislocated and is triggering or bypassing policies unexpectedly.
2. Add the affected IP to a named location
   • Go to Entra ID > Conditional Access > Named locations.
   • Create or edit a named location and add the specific public IPv4/IPv6 address or range corresponding to the customer’s egress IP.
   • Optionally mark it as a trusted location if appropriate for the organization’s security model.
   • Update Conditional Access policies to include or exclude this named location as needed so that policy enforcement aligns with the customer’s real-world location and risk posture, regardless of external geolocation data.
3. Handle IP mismatches and split tunneling
   • If the identity provider and resource see different IPs (for example, due to split tunneling or different IPv4/IPv6 paths), Entra may see one IP while the resource sees another. This can cause unexpected Conditional Access behavior.
   • Use the Continuous Access Evaluation Insights workbook and the IP address (seen by resource) field in sign-in logs to identify such mismatches.
   • Add the resource-side IPs to named locations to avoid unintended blocks when strict location enforcement or CAE-based reevaluation is in use.
4. Carefully roll out strict location enforcement
   • If strict location enforcement with Continuous Access Evaluation is enabled, roll out to user groups in stages and continuously review sign-in logs for blocked events where IP address (seen by resource) is not in a named location.
   • Add any legitimate egress IPs discovered during this process to named locations to prevent further disruption.

These steps ensure that Conditional Access decisions are based on the organization’s explicitly defined IP ranges and trusted locations, mitigating the impact of incorrect public IP geolocation without relying on external geolocation corrections.

References:

• Strictly enforce location policies using continuous access evaluation (preview)
• Monitor and troubleshoot continuous access evaluation
• Conditional Access: Network assignment