Microsoft Entra's Sign In Logs Incorrect Location on IP Addresses.

Microsoft Entra sign-in logs determine location from the public IP address seen at the time of authentication. The location shown can differ from the user’s actual physical location for several reasons:

1. Network routing and proxies/VPNs
   Traffic can be routed through distant or centralized egress points (for example, a US-based proxy or ISP gateway), so the public IP that Entra sees geolocates to Wichita, Kansas even though the user is in Karachi. This is common with mobile networks and corporate VPNs and can generate false “impossible travel” detections.
2. Shared or unknown egress IPs
   In complex or split-tunnel network topologies, Microsoft Entra ID and the resource can see different IP addresses for the same session. Entra uses the IP it sees to determine location, which may not match the user’s true geography.
3. IP geolocation limitations
   Geolocation is based on IP-to-location databases that can be inaccurate or lag behind ISP changes. This can cause an IP assigned in Pakistan to be mapped to a US city.

To reduce false “impossible traveler” alerts and improve accuracy:

1. Baseline and validate known egress IPs
   • Identify the known public/egress IP addresses for the organization and the countries/regions users operate from.
   • Use this baseline when reviewing sign-in logs and risk detections.
2. Use named locations for trusted IPs
   • In the Microsoft Entra admin center, go to Entra ID → Conditional Access → Named locations and add the organization’s known public IPs as trusted named locations.
   • This helps Conditional Access and risk policies distinguish expected traffic from suspicious locations.
3. Monitor unusual sign-ins with Entra ID Protection
   • Use Microsoft Entra ID Protection and sign-in logs to monitor for unusual sign-ins (for example, successful authentications from countries/regions where the organization doesn’t operate).
   • Tune alerts and baselines so that known egress IPs and expected geographies (such as Karachi) are treated as normal, reducing false positives.
4. Review sign-in details beyond location
   • When investigating “impossible travel” or unusual sign-ins, verify not just the location but also device info, browser, OS, and application to distinguish real compromise from geolocation anomalies.

If the IP address is confirmed (via external lookup) to belong to Karachi but Entra maps it to Wichita, this is a geolocation artifact rather than a tenant misconfiguration. The mitigation is to rely on known egress IPs, named locations, and tuned risk policies rather than raw city labels alone.

References:

• Microsoft Entra security operations for user accounts
• View your work or school account sign-in activity from My Sign-ins