I've been dealing with frustrating issues regarding incorrect geolocation data on IP addresses related to Microsoft Entra, particularly when it comes to conditional access. It can take weeks or even months for Microsoft to update their IP database when a subnet is incorrectly assigned to the wrong country. This becomes a headache if the erroneous location leads to access restrictions. I've tried reaching out to both M365 and Azure support multiple times, providing detailed information including links to the RIPE database, but it hasn't sped up the process. I'm curious if anyone has found a more effective method to prompt Microsoft to fix their GeoIP database without excessive back-and-forth communication. Also, does anyone know if Microsoft uses geofeed data as per the RFC standards, or do they ignore that information?
5 Answers
I opened a ticket regarding our main office's IP being classified wrong, and while they did eventually fix it, I had to explain the same issue multiple times over several weeks. It's frustrating when other Geo-IP databases get it right, but Microsoft doesn't.
Trust me, a layered security approach is essential. I faced a similar issue where an IP was incorrectly geolocated to Boca Raton, Florida, while the RIPE info clearly showed it was in Italy. Thankfully, we had other measures in place that helped us effectively mitigate any potential issues, even when Microsoft dropped the ball.
How can you track a real location without GPS? Like, would pinging services like Cloudflare or Akamai even work?
In a related scenario, our office switched ISPs and got new static IPs that Microsoft misclassified, causing connectivity issues. It's been tough finding a reliable way to prompt Microsoft for fixes with solid evidence.
You might want to check out the MaxMind database, which many organizations, including Okta, rely on. They usually process update requests pretty quickly, often within a week or two.
Getting the current owner of the IP space involved can really help in pushing Microsoft to correct their GeoIP database. It's worth reaching out to them if you can!
Do you know where Microsoft gets their geo information from?
It’s true that there isn't just one universal GeoIP database; it's a mix of sources.
Our approach is pretty strict: we block everything except access from our country, whitelist our company’s outgoing IPs, and maintain firewall rules to limit VPN use. It keeps us safe and out of these geolocation issues.
So you're saying the only way is to persistently keep contacting Microsoft support until they finally take action?