Geolocalization problems with /21s

Hello @Costa-Rica-01,

I have received an update from our engineering team that they have the IP address with correct location. Please check your sign-ins and let me know if it still shows incorrect location at your end.

• Incorrect Location: United States, Utah, Lehi
• Correct Location: Costa Rica, San Jose, San Jose

I hope this information is helpful. Please feel free to reach out if you have any further questions.

Microsoft Sentinel’s geolocation enrichment is based on Microsoft’s internal IP intelligence data, not directly on RIR WHOIS, so newly transferred prefixes can continue to resolve to the previous owner’s country until Microsoft’s data is updated.

For services that use this geolocation (for example, Conditional Access decisions that depend on IP location), the only supported way to influence the result is to have Microsoft update the internal IP intelligence for the affected prefixes.

The documented, product-level interface to that data is the Microsoft Sentinel Geolocation Data API, which exposes the current view of an IP’s location:

GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.SecurityInsights/enrichment/ip/geodata/?ipaddress={ipAddress}&api-version={api-version}

The response includes fields such as country, region, city, latitude, longitude, and organization, which reflect Microsoft’s current geolocation for that IP.

To resolve the issue for the two /21 blocks:

1. Use the Geolocation Data API for sample IPs in each /21
   • Call the API for several representative IPs from each prefix.
   • Confirm that country (and related fields) still show the United States.
2. Open a support case with Microsoft
   • Because the IP-to-location mapping is maintained internally, corrections must be requested through Microsoft support.
   • In the support request, provide:
     • The affected prefixes (both /21s).
     • Your ASN.
     • RIR registration details (ARIN/RIPE records showing your organization and country).
     • Example IPs and the incorrect geolocation results from the Geolocation Data API.
   • Ask for an update of Microsoft’s IP intelligence/geo database for those prefixes so that services such as Entra ID Conditional Access and Teams reflect the correct country.
3. Validate after Microsoft updates the data
   • Once Microsoft confirms the update, re-query the same IPs via the Geolocation Data API.
   • Verify that country and related fields now show your country instead of the United States.
   • After propagation, Conditional Access and other Microsoft services that rely on this data should begin using the corrected location.

Note: The Geolocation Data API is rate-limited to 100 calls per user per hour, so testing should be done with a limited set of sample IPs.

References:

• Enrich entities in Microsoft Sentinel with geolocation data via REST API (Public preview)