We had a user report as a Risky Sign in due to a sign in from a completely different country.
The IP address reported in the Sign-In activity log as being reported in Brazil, while the user was signing in from his Mobile device using mobile data in South Africa
I'm pretty sure there's a disclaimer in the documentation, saying this data is not always correct. You shouldn't rely on it, moreover Microsoft is introducing actual GPS-based location condition, which will make this obsolete.
