IP geolocation correction: 40.27.32.0/24 shown as Hong Kong in Entra ID, actual location Ashburn, Virginia, US

Question

IP geolocation correction: 40.27.32.0/24 shown as Hong Kong in Entra ID, actual location Ashburn, Virginia, US

Ajeet Singh 0

We are BrowserStack, the network operator for 40.27.32.0/24 and 40.27.33.0/24. Both prefixes are announced from AS402165 and are physically located in Ashburn, Virginia, United States.

Microsoft's IP geolocation, as seen in Entra ID sign-in logs, places IPs in this range (for example 40.27.32.2 and 40.27.32.3) in Hong Kong. Because of this, customers whose Conditional Access policies allow only US sign-ins are blocked with error 53003.

Evidence that the range is in Ashburn, VA, US:

RFC 8805 geofeed (https://geofeed.ipxo.com/geofeed.txt):
- 40.27.32.0/24,US,US-VA,Ashburn
- 40.27.33.0/24,US,US-VA,Ashburn
BGP: AS402165 (BrowserStack, Inc.) originates both prefixes. You can check this on RIPEstat: https://stat.ripe.net/40.27.32.0/24
MaxMind GeoLite: 40.27.32.0/24 = United States, Ashburn
ip-api.com: 40.27.32.2 and 40.27.32.3 = Ashburn, Virginia, United States (AS402165)
ARIN registration: NET-40-27-32-0-1 (40.27.32.0–40.27.32.255)
IPXO, the IP lessor, has confirmed in writing that the range is registered to Ashburn, Virginia, US.

What we are asking for:

Please update Microsoft's IP geolocation data (the source used by Entra ID / Azure AD sign-in logs and Conditional Access Named Locations) so that 40.27.32.0/24 and 40.27.33.0/24 map to United States (Ashburn, Virginia) instead of Hong Kong.
Please also have Microsoft's geolocation pipeline ingest our geofeed at https://geofeed.ipxo.com/geofeed.txt, so future changes stay correct.
If this forum isn't the right channel, please forward this to the team that owns IP geolocation (Entra ID / Bing geolocation), or tell us the correct way to submit the request.

We can provide any further verification you need. Thank you.

0 comments

1 answer

Your answer

Answer 1

Microsoft Q&A cannot directly update the geolocation database used by Microsoft Entra ID. The correction should be submitted through Microsoft's IP geolocation correction process:

https://www.microsoft.com/en-us/msrc/geolocation

Submit both prefixes, 40.27.32.0/24 and 40.27.33.0/24, and include the actual country, state, and city; the originating ASN and organization; the RFC 8805 geofeed URL; RIR or ARIN registration; representative IP addresses; and a technical contact who can validate control of the ranges. Keep the submission or case reference so affected customers can refer to it in their Entra support cases.

Updates are not immediate because the corrected data must be validated and propagated through Microsoft's geolocation services. Entra sign-in logs can continue to show the previous location during that propagation period.

For customers currently blocked by Conditional Access error 53003, do not disable Conditional Access. After independently validating the prefixes, an administrator can create a named location based on the explicit CIDR ranges and adjust the relevant policy to use that named location while the geolocation correction propagates. The policy change should be tested in report-only mode first and reviewed according to the organization's security change process.

If the correction form does not resolve the issue, open a Microsoft Entra support request and provide the correction-request reference, tenant ID, affected sign-in correlation IDs, UTC timestamps, the two prefixes, and the geofeed and routing evidence through the secure case. That allows support to route the issue to the service team that owns Entra's IP geolocation data.