IP6 on AT&T causing Impossible Travel alerts from Tanzania

John Rezek-DA 6 Reputation points
2021-09-12T16:33:04.583+00:00

Anyone finding issue with users that have AT&T Plan on phones that keeps causing Logon message from Tanzania. I have about 7 users so far and while I'm concerned, I have technicians stating it is a false positive. I want to be sure since this is disconcerting.

Not Monitored
Not Monitored
Tag not monitored by Microsoft.
35,947 questions
0 comments

5 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Kurtis 1 Reputation point
    2021-09-13T12:00:31.757+00:00

    YES!!!

    Literally just got notifications this morning that I have to investigate. I have received them in the past too but always hit a dead end.

    0 comments
  2. Kurtis 1 Reputation point
    2021-09-13T12:06:00.793+00:00

    YES!

    I am also getting these alerts for what seem to be AT&T iPhones. I don't have any other information, but I will inquire with our AT&T rep.

  3. Spicy 1 Reputation point
    2021-09-14T11:43:38.617+00:00

    Hello Microsoft !

    0 comments
  4. Violet, Andrew 1 Reputation point
    2021-09-14T15:11:25.833+00:00

    We have several users who flagged an alert on this too. All of them show an impossible travel from Tanzania using an IPV6 address. Interesting that the ISP are all mobile carriers showing AT&T, T-Mobile and Verizon. No explanation anywhere.

    0 comments
  5. Spicy 1 Reputation point
    2021-09-14T15:14:31.767+00:00

    September 13, 2021 12:39 PM
    Title: Admins are seeing incorrect activity locations within the Microsoft Cloud App Security portal

    User Impact: Admins are seeing incorrect activity locations within the Microsoft Cloud App Security portal.

    Current status: We've identified a recent change in the geo-location provider service that is causing admins to see locations for some activities to be incorrectly reported as Tanzania within the Microsoft Cloud App Security portal. The team is working on a fix to revert the change and remediate impact.

    Scope of impact: Your organization is affected by this event, and this issue may potentially affect any of your admins attempting to view activity locations within the Microsoft Cloud App Security portal.

    Start time: Thursday, September 9, 2021, 1:29 PM (5:29 PM UTC)

    Root cause: A recent update to the geo-location provider service is causing admins to see incorrect locations within the Microsoft Cloud App Security portal.

    Next update by: Wednesday, September 15, 2021, 10:00 AM (2:00 PM UTC)