Location Intelligence

See where every action really comes from - spot impossible travel, risky networks, and account compromise, while cutting through Microsoft's own datacenter noise.

Every action in your Microsoft 365 environment happens somewhere. Location Intelligence turns the raw, throwaway IP addresses buried in your audit logs into a clear, human answer to a deceptively hard question: "Where is this activity actually coming from - and should I be worried about it?"

Knowing where your people work is one of the strongest security signals you have, and the cheapest to check. If your company operates in Europe, a document library downloaded from Asia at three in the morning is a red flag before anyone looks at behaviour, permissions or file contents - no modelling, no baseline, no tuning. Stolen credentials are used from wherever the attacker happens to be, and that is rarely where the employee sits.

What You Can Achieve

Catch account takeover

Spot a user signing in from a country they've never been to, or from Tor / a VPN / a hosting provider - the classic fingerprints of stolen credentials.

Investigate an incident fast

A sensitive file was downloaded at 3 AM. Was it from the user's normal city, or from a datacenter on the other side of the world? Answer it in one click.

Cut through Microsoft's noise

Stop chasing phantom 'US datacenter' logins for a user sitting in Warsaw. We recognise Microsoft's own backend traffic and label it clearly.

Understand normal, so you can see abnormal

Per-user and per-device travel timelines show you where each identity usually operates, making the outliers obvious.

Where a Location Comes From

A Location in 1Security is not an IP address. Raw IPs are noisy and disposable - a single user on a phone might use dozens in a day. Instead, we resolve each event's network address into a stable, meaningful identity made of three parts:

Country and City - where the activity appears to originate.
Network (ASN) - who owns the connection: a home ISP, a corporate network, a mobile carrier, a cloud provider, or an anonymity service.

Dynamic IPs that all belong to the same place collapse into one Location, so you see "Warsaw, Poland - home ISP" once, not two hundred fleeting addresses.

The Signals That Matter

Beyond the map, 1Security classifies the type of network behind each action. This is often the real story:

Standard - an ordinary residential or corporate connection. Expected.
VPN - traffic routed through a commercial VPN. Sometimes legitimate, sometimes an attacker hiding their true location.
Tor - the anonymity network. Almost never a normal way for an employee to open a spreadsheet.
Datacenter - a hosting/cloud provider. A person browsing files from a datacenter is unusual and worth a look.
Microsoft - Microsoft's own infrastructure (see below).

VPN, Tor, and datacenter egress on a user's activity is one of the strongest early signals of a stolen session or compromised account. Location Intelligence surfaces it automatically - no rules to write.

The Microsoft Relay Problem (and How We Solve It)

Here is a subtlety that trips up almost every security tool: many Microsoft 365 actions do not carry the user's real IP address. When a server-side operation happens - adding a mailbox permission, a background SharePoint action, a Copilot interaction - Microsoft often records the IP of its own datacenter, not the person who triggered it.

Left unhandled, this floods your logs with hundreds of "logins from a US datacenter" for users who never left the office. It buries real threats in false alarms.

1Security handles this in two ways:

We recognise Microsoft's own networks - across both IPv4 and IPv6 ranges - and label that traffic clearly as Microsoft origin, styled neutrally rather than as a suspicious datacenter.
We use Microsoft's own location signal when it's available. Microsoft frequently includes the user's real country alongside the relayed IP. We trust that over the meaningless address of the relay, so a file previewed by someone in Poland reads as Poland - even though the underlying connection was a Microsoft server in the US.

Crucially, we do this by recognising Microsoft's infrastructure, never by assuming "any foreign-looking activity is just Microsoft." A genuine sign-in from an unexpected country stays fully visible - because that might be exactly the compromise you need to catch.

Conditional Access, Laid Over What You Observe

Locations answer where your people work. Conditional Access declares where you allow them to work from. Neither half is worth much alone - and the interesting part is always the difference between them.

Grant the read-only Policy.Read.All permission and 1Security pulls your named locations and Conditional Access policies, then matches them against every location it has already resolved. Each place gets a coverage verdict - not covered, partly covered, named, trusted - computed from the source addresses actually seen there rather than from the policy's stated scope, plus findings such as an office that sits outside every trusted range, a trusted range that resolves to a VPN, or sign-ins that completed with no policy in force at all.

This is exactly the pairing neither side can produce on its own: the Entra portal knows what you declared but has never seen your traffic; a location list knows your traffic but not what you promised about it.

Coverage lives on the Conditional Access tab of the Locations screen, as a CA coverage column on the location lists, and as a per-location tab in the drawer. See Conditional Access for the full picture, including the named-locations view and what each finding means.

Where You'll See It

Location Intelligence is woven through the product rather than hidden on one screen:

Activity Logs gain Location and Infrastructure columns, plus filters for country, network type, and whether a location is new for that user.
User and Device drawers include a Locations tab - a travel timeline of everywhere that identity has been seen active, newest first. Click any location to jump straight to the exact events that came from it.
First-seen detection flags the first time a user is observed at a given location - a lightweight, high-signal indicator of a new or anomalous session.

Licensing

Like the rest of 1Security, Location Intelligence works with a standard Microsoft 365 license. Enrichment runs locally and privately - we never send your IP data to a third-party lookup service. No Microsoft E5, Entra ID P2, or premium sign-in log add-on is required.