Geo Location IP address incorrect

%3CLINGO-SUB%20id%3D%22lingo-sub-2475018%22%20slang%3D%22en-US%22%3EGeo%20Location%20IP%20address%20incorrect%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2475018%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20had%20a%20user%20report%20as%20a%20Risky%20Sign%20in%20due%20to%20a%20sign%20in%20from%20a%20completely%20different%20country.%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20IP%20address%20reported%20in%20the%20Sign-In%20activity%20log%20as%20being%20reported%20in%20Brazil%2C%20while%20the%20user%20was%20signing%20in%20from%20his%20Mobile%20device%20using%20mobile%20data%20in%20South%20Africa%3C%2FP%3E%3CP%3E%3CBR%20%2F%3EAzure%20AD%20Info%3C%2FP%3E%3CP%3E%3CSPAN%3ELocation%3C%2FSPAN%3E%3C%2FP%3E%3CDIV%20class%3D%22fxc-weave-pccontrol%20fxc-section-control%20fxc-base%20msportalfx-customHtml%20msportalfx-form-formelement%20fxc-has-label%20fxc-left-label%22%3E%3CDIV%20class%3D%22azc-formElementSubLabelContainer%22%3E%3CDIV%20class%3D%22azc-formElementContainer%22%3E%3CDIV%3ESao%20Paulo%2C%20Sao%20Paulo%2C%20BR%3CBR%20%2F%3E%3CSPAN%3EIP%20address%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FDIV%3E%3CDIV%20class%3D%22fxc-weave-pccontrol%20fxc-section-control%20fxc-base%20msportalfx-customHtml%20msportalfx-form-formelement%20fxc-has-label%20fxc-left-label%22%3E%3CDIV%20class%3D%22azc-formElementSubLabelContainer%22%3E%3CDIV%20class%3D%22azc-formElementContainer%22%3E%3CDIV%3E41.116.61.19%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3EIP%20Location%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fwww.iplocation.net%2Fip-lookup%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noreferrer%22%3EIP%20Location%20Finder%20-%20Geolocation%3C%2FA%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3ELocation%3A%20South%20Africa%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3ECarrier%3A%20MTN%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3EAll%204%20Geo%20Location%20DB's%20report%20South%20Africa%2C%20yet%20Microsoft%20reports%20Brazil%3F%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3EWhat%20GEO%20DB%20is%20Microsoft%20using%20and%20how%20can%20we%20mitigate%20this%20going%20forward%20%3F%20Any%20suggestions%20%3F%26nbsp%3B%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2475018%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20AD%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EIdentity%20Management%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2477671%22%20slang%3D%22en-US%22%3ERe%3A%20Geo%20Location%20IP%20address%20incorrect%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2477671%22%20slang%3D%22en-US%22%3EI'm%20pretty%20sure%20there's%20a%20disclaimer%20in%20the%20documentation%2C%20saying%20this%20data%20is%20not%20always%20correct.%20You%20shouldn't%20rely%20on%20it%2C%20moreover%20Microsoft%20is%20introducing%20actual%20GPS-based%20location%20condition%2C%20which%20will%20make%20this%20obsolete.%3C%2FLINGO-BODY%3E
Occasional Visitor

We had a user report as a Risky Sign in due to a sign in from a completely different country. 

The IP address reported in the Sign-In activity log as being reported in Brazil, while the user was signing in from his Mobile device using mobile data in South Africa


Azure AD Info

Location

Sao Paulo, Sao Paulo, BR
IP address
41.116.61.19
 
Location: South Africa
Carrier: MTN
 
All 4 Geo Location DB's report South Africa, yet Microsoft reports Brazil?
What GEO DB is Microsoft using and how can we mitigate this going forward ? Any suggestions ? 
1 Reply
I'm pretty sure there's a disclaimer in the documentation, saying this data is not always correct. You shouldn't rely on it, moreover Microsoft is introducing actual GPS-based location condition, which will make this obsolete.