This morning, I've run into a strange issue where Azure is identifying a bunch of my users as coming from a Canadian IP address, which is causing them to get blocked from accessing Office 365. We have a static IP set up correctly on both our primary and secondary ISPs, and when I check what's my IP, it matches up fine. However, Microsoft insists that these users are located in Toronto, Canada. This issue popped up suddenly at around 5 AM EST, and I verified that there have been no changes to our Conditional Access Policies since yesterday that could have triggered this. Has anyone else experienced a similar issue?
3 Answers
If you’re sure the IPs are static and they aren’t located in Canada, you might want to consider excluding them from the location blocking in your Conditional Access Policies. But I get wanting to double-check that this isn’t something more suspicious first.
Yeah, Microsoft’s GeoIP data can be pretty inconsistent. I’ve got users on a static /48 prefix, and Azure keeps bouncing them around between the UK, US, and Germany. It’s a headache for sure!
It’s not the first time Microsoft’s Geo IP database has had some quirks. Remember that one time when everyone seemed to be from Ulaanbaatar? It might be worth looking into whether this is an error on Microsoft's part or if it’s due to incorrect data sources.
That’s a good point! I’d prefer to clear this up first and confirm it’s not a security concern. If it turns out to be an MS issue, we can open up access for Canada.