Location Intelligence

Every action in your Microsoft 365 environment happens somewhere. Location Intelligence turns the raw, throwaway IP addresses buried in your audit logs into a clear, human answer to a deceptively hard question: "Where is this activity actually coming from - and should I be worried about it?"

Knowing where your people work is one of the strongest security signals you have, and the cheapest to check. If your company operates in Europe, a document library downloaded from Asia at three in the morning is a red flag before anyone looks at behaviour, permissions or file contents - no modelling, no baseline, no tuning. Stolen credentials are used from wherever the attacker happens to be, and that is rarely where the employee sits.

What You Can Achieve

Where a Location Comes From

A Location in 1Security is not an IP address. Raw IPs are noisy and disposable - a single user on a phone might use dozens in a day. Instead, we resolve each event's network address into a stable, meaningful identity made of three parts:

• Country and City - where the activity appears to originate.
• Network (ASN) - who owns the connection: a home ISP, a corporate network, a mobile carrier, a cloud provider, or an anonymity service.

Dynamic IPs that all belong to the same place collapse into one Location, so you see "Warsaw, Poland - home ISP" once, not two hundred fleeting addresses.

One Place, One Row

Audit logs are chaos about place. The same physical location arrives under many names - a district here, a city there, a different spelling in the next record - and underneath it all sit disposable IP addresses that change by the hour. Try forensics on that raw material and you end up chasing near-duplicates that each hold a slice of the story, or missing the story entirely.

1Security turns that chaos into a coherent map: whatever name a record arrives under, it resolves to the one place it really is - so a location's full history, every user, device, and event, lives in a single row and a single drawer. The precise original label is preserved and shown ("Łódź · Widzew"), so nothing is lost in the tidying - and genuinely distinct places stay distinct, never merged just for being small or close together.

The Signals That Matter

Beyond the map, 1Security classifies the type of network behind each action. This is often the real story:

• Standard - an ordinary residential or corporate connection. Expected.
• VPN - traffic routed through a commercial VPN. Sometimes legitimate, sometimes an attacker hiding their true location.
• Tor - the anonymity network. Almost never a normal way for an employee to open a spreadsheet.
• Datacenter - a hosting/cloud provider. A person browsing files from a datacenter is unusual and worth a look.
• Microsoft - Microsoft's own infrastructure (see below).

Classification is built to not go stale. Cloud providers reshuffle their IP ranges constantly - faster than any geolocation database tracks - so 1Security reads the range files the vendors themselves publish (Azure Service Tags, AWS and Google Cloud range feeds) and refreshes them automatically, region included: a range Azure moved to Poland Central reads as Poland, not as whatever a lagging database remembers. Tor exits are matched against the Tor Project's own published exit list, refreshed daily - not a heuristic, a lookup against ground truth.

The Microsoft Relay Problem (and How We Solve It)

Here is a subtlety that trips up almost every security tool: many Microsoft 365 actions do not carry the user's real IP address. When a server-side operation happens - adding a mailbox permission, a background SharePoint action, a Copilot interaction - Microsoft often records the IP of its own datacenter, not the person who triggered it.

Left unhandled, this floods your logs with hundreds of "logins from a US datacenter" for users who never left the office. It buries real threats in false alarms.

1Security handles this in two ways:

1. We recognise Microsoft's own networks - across both IPv4 and IPv6 ranges - and label that traffic clearly as Microsoft origin, styled neutrally rather than as a suspicious datacenter.
2. We use Microsoft's own location signal when it's available. Microsoft frequently includes the user's real country alongside the relayed IP. We trust that over the meaningless address of the relay, so a file previewed by someone in Poland reads as Poland - even though the underlying connection was a Microsoft server in the US.

Conditional Access, Laid Over What You Observe

Locations answer where your people work. Conditional Access declares where you allow them to work from. Neither half is worth much alone - and the interesting part is always the difference between them.

Grant the read-only Policy.Read.All permission and 1Security pulls your named locations and Conditional Access policies, then matches them against every location it has already resolved. Each place gets a coverage verdict - not covered, partly covered, named, trusted - computed from the source addresses actually seen there rather than from the policy's stated scope, plus findings such as an office that sits outside every trusted range, a trusted range that resolves to a VPN, or sign-ins that completed with no policy in force at all.

This is exactly the pairing neither side can produce on its own: the Entra portal knows what you declared but has never seen your traffic; a location list knows your traffic but not what you promised about it.

When You Know Better: Corrections and Judgments

No dataset beats the admin who knows their own environment. Every location can be reported from its drawer - and the report does different things depending on what you are saying:

• "The classification is wrong" - reclassify a network (an ISP mis-labelled as a datacenter, an unlisted VPN service). Applies instantly, survives every future data refresh, and can cover the whole network or just the one location.
• "The place is wrong" - propose the correct country or city; 1Security re-derives the tenant's location data in the background.
• "Expected" / "Suspicious" - a judgment, not a fact. Marking your red team's Tor exit as expected removes it from the suspicious-network surfaces and lets new policies skip it - while it still honestly reads as Tor. Facts and judgments never overwrite each other.

Guardrails keep one click from rewriting reality:

• Networks whose classification comes from the vendor's own published ranges (Microsoft, AWS, Google Cloud) cannot be reclassified wholesale - a whole-network change there would silently void dozens of locations at once. Correcting a single odd location is always possible.
• Tor status cannot be reclassified at all - it is verified against the Tor network's published exit list. The right tool for "this Tor exit is ours" is Mark as expected.
• A whole-network change that would touch many locations is refused with the count, and the dialog suggests scoping to the one location instead.

Corrections about public networks can optionally be shared with 1Security (a separate, opt-out setting in Settings → Integrations) so geolocation improves for every customer - vetted by a human before anything reaches anyone else, and carrying only public network identifiers. Reports about your own infrastructure, and all expected/suspicious judgments, never leave your tenant - that exclusion is enforced server-side, not by a checkbox. The full transparency contract is in Data handling.

Where You'll See It

Location Intelligence is woven through the product rather than hidden on one screen:

• Activity Logs gain Location and Infrastructure columns, plus filters for country, network type, and whether a location is new for that user.
• User and Device drawers include a Locations tab - a travel timeline of everywhere that identity has been seen active, newest first. Click any location to jump straight to the exact events that came from it.
• First-seen detection flags the first time a user is observed at a given location - a lightweight, high-signal indicator of a new or anomalous session.

Licensing

Like the rest of 1Security, Location Intelligence works with a standard Microsoft 365 license. Enrichment runs locally and privately - we never send your IP data to a third-party lookup service. No Microsoft E5, Entra ID P2, or premium sign-in log add-on is required.