---
title: Location Intelligence
description: See where every action really comes from - spot impossible travel, risky networks, and account compromise, while cutting through Microsoft's own datacenter noise.
icon: MapPin
---

Every action in your Microsoft 365 environment happens _somewhere_. Location Intelligence turns the raw, throwaway IP addresses buried in your audit logs into a clear, human answer to a deceptively hard question: **"Where is this activity actually coming from - and should I be worried about it?"**

Knowing where your people work is one of the strongest security signals you have, and the cheapest to check. If your company operates in Europe, a document library downloaded from Asia at three in the morning is a red flag before anyone looks at behaviour, permissions or file contents - no modelling, no baseline, no tuning. Stolen credentials are used from wherever the attacker happens to be, and that is rarely where the employee sits.

## What You Can Achieve

<Cards>
  <Card
    title="Catch account takeover"
    description="Spot a user signing in from a country they've never been to, or from Tor / a VPN / a hosting provider - the classic fingerprints of stolen credentials."
  />
  <Card
    title="Investigate an incident fast"
    description="A sensitive file was downloaded at 3 AM. Was it from the user's normal city, or from a datacenter on the other side of the world? Answer it in one click."
  />
  <Card
    title="Cut through Microsoft's noise"
    description="Stop chasing phantom 'US datacenter' logins for a user sitting in Warsaw. We recognise Microsoft's own backend traffic and label it clearly."
  />
  <Card
    title="Understand normal, so you can see abnormal"
    description="Per-user and per-device travel timelines show you where each identity usually operates, making the outliers obvious."
  />
</Cards>

## Where a Location Comes From

A **Location** in 1Security is not an IP address. Raw IPs are noisy and disposable - a single user on a phone might use dozens in a day. Instead, we resolve each event's network address into a stable, meaningful identity made of three parts:

- **Country and City** - _where_ the activity appears to originate.
- **Network (ASN)** - _who_ owns the connection: a home ISP, a corporate network, a mobile carrier, a cloud provider, or an anonymity service.

Dynamic IPs that all belong to the same place collapse into one Location, so you see "Warsaw, Poland - home ISP" once, not two hundred fleeting addresses.

## The Signals That Matter

Beyond the map, 1Security classifies the **type of network** behind each action. This is often the real story:

- **Standard** - an ordinary residential or corporate connection. Expected.
- **VPN** - traffic routed through a commercial VPN. Sometimes legitimate, sometimes an attacker hiding their true location.
- **Tor** - the anonymity network. Almost never a normal way for an employee to open a spreadsheet.
- **Datacenter** - a hosting/cloud provider. A person browsing files from a datacenter is unusual and worth a look.
- **Microsoft** - Microsoft's own infrastructure (see below).

<Callout type="info">
  VPN, Tor, and datacenter egress on a user's activity is one of the strongest
  early signals of a stolen session or compromised account. Location
  Intelligence surfaces it automatically - no rules to write.
</Callout>

## The Microsoft Relay Problem (and How We Solve It)

Here is a subtlety that trips up almost every security tool: **many Microsoft 365 actions do not carry the user's real IP address.** When a server-side operation happens - adding a mailbox permission, a background SharePoint action, a Copilot interaction - Microsoft often records the IP of _its own datacenter_, not the person who triggered it.

Left unhandled, this floods your logs with hundreds of "logins from a US datacenter" for users who never left the office. It buries real threats in false alarms.

1Security handles this in two ways:

1. **We recognise Microsoft's own networks** - across both IPv4 and IPv6 ranges - and label that traffic clearly as **Microsoft** origin, styled neutrally rather than as a suspicious datacenter.
2. **We use Microsoft's own location signal when it's available.** Microsoft frequently includes the user's _real_ country alongside the relayed IP. We trust that over the meaningless address of the relay, so a file previewed by someone in Poland reads as Poland - even though the underlying connection was a Microsoft server in the US.

<Callout type="warn">
  Crucially, we do this by recognising Microsoft's *infrastructure*, never by
  assuming "any foreign-looking activity is just Microsoft." A genuine sign-in
  from an unexpected country stays fully visible - because that might be exactly
  the compromise you need to catch.
</Callout>

## Conditional Access, Laid Over What You Observe

Locations answer _where your people work_. Conditional Access declares _where you allow them to work from_. Neither half is worth much alone - and the interesting part is always the difference between them.

Grant the read-only `Policy.Read.All` permission and 1Security pulls your named locations and Conditional Access policies, then matches them against every location it has already resolved. Each place gets a coverage verdict - **not covered**, **partly covered**, **named**, **trusted** - computed from the source addresses actually seen there rather than from the policy's stated scope, plus findings such as an office that sits outside every trusted range, a trusted range that resolves to a VPN, or sign-ins that completed with no policy in force at all.

This is exactly the pairing neither side can produce on its own: the Entra portal knows what you declared but has never seen your traffic; a location list knows your traffic but not what you promised about it.

<Callout type="info">
  Coverage lives on the **Conditional Access** tab of the Locations screen, as a
  **CA coverage** column on the location lists, and as a per-location tab in the
  drawer. See [Conditional Access](/en/docs/conditional-access) for the full
  picture, including the named-locations view and what each finding means.
</Callout>

## Where You'll See It

Location Intelligence is woven through the product rather than hidden on one screen:

- **Activity Logs** gain **Location** and **Infrastructure** columns, plus filters for country, network type, and whether a location is new for that user.
- **User and Device drawers** include a **Locations** tab - a travel timeline of everywhere that identity has been seen active, newest first. Click any location to jump straight to the exact events that came from it.
- **First-seen detection** flags the first time a user is observed at a given location - a lightweight, high-signal indicator of a new or anomalous session.

## Licensing

Like the rest of 1Security, Location Intelligence works with a **standard Microsoft 365 license**. Enrichment runs locally and privately - we never send your IP data to a third-party lookup service. No Microsoft E5, Entra ID P2, or premium sign-in log add-on is required.