How do I request a correction to Microsoft IP geolocation data for a newly registered IP block?

Open an Azure technical support request against the affected Front Door/WAF resource and ask support to escalate an IP geolocation dataset correction to the Azure Front Door/WAF product team.

Submit the correction request

1. In the Azure portal, open the affected Front Door profile or WAF policy.
2. From the resource menu, select Support + Troubleshooting.
3. Complete the diagnostics. If they do not resolve the issue, select Create a support request.
4. Select:
   • Issue type: Technical
   • Service: Azure Front Door or Azure Web Application Firewall, whichever is offered for the affected resource
   • The closest available problem type for WAF custom rules, geo-filtering, or blocked traffic.
5. Use a title such as:

   Azure Front Door WAF GeoMatch incorrectly classifies newly allocated ARIN prefix

6. Include:
   • The complete IPv4 prefix, provided privately in the ticket.
   • ASN and ISP name.
   • ARIN allocation/RDAP evidence and allocation date.
   • Intended country code: US.
   • Any published geofeed.
   • Front Door profile and WAF policy resource names.
   • UTC timestamps, request IDs, and WAF log entries for rejected requests.
   • The custom rule’s match variable, values, negation setting, action, and priority.
   • A statement that the prefix was previously unallocated and other major datasets now classify it as United States.
   • A specific request to correct the Microsoft geolocation dataset consumed by Azure Front Door/WAF GeoMatch, rather than merely change the WAF policy.

Creating a technical request requires an Azure support plan and subscription-level Owner, Contributor, Support Request Contributor, or equivalent Microsoft.Support/* permission. The portal also lets the request be opened from the global ? menu if the resource-level path is unavailable.^1^

There is no documented public self-service form in the available Microsoft guidance for submitting Front Door/WAF geolocation corrections. Microsoft Q&A cases show that Microsoft moderators can privately collect affected prefixes and engage the product team, which has corrected Microsoft’s backend location data in prior mismatch cases.^2^ For a production WAF incident, however, the Azure support request is the direct route because it is tied to the affected subscription and resource. If a support request cannot be created, post to Microsoft Q&A with both the Azure Web Application Firewall and Azure Front Door tags, but keep the actual prefix private until Microsoft staff provide a private-message channel.^3^

Verify what WAF is classifying

Before attaching evidence, use WAF diagnostic logs to identify the evaluated source address and matched rule. For Azure Front Door WAF, Microsoft’s GeoMatch examples use SocketAddr, the source IP seen by WAF; a proxy or VPN can therefore cause WAF to evaluate a different address than the subscriber’s assigned address.^4^

This check distinguishes:

• The new prefix is evaluated and classified as ZZ/Unknown.
• It is assigned an incorrect country.
• WAF is evaluating a proxy, VPN, or other source address instead.

Do not publish the unredacted prefix or customer request details in the public Q&A post.

Temporary mitigation for ZZ/Unknown

If logs establish that the prefix is unmapped, add ZZ to the permitted GeoMatch values while Microsoft processes the correction. Microsoft defines ZZ as addresses not yet mapped to a country or region and explicitly recommends including it to avoid false-positive blocks.^5^

For a “block everything except the US” rule, use:

• Match variable: SocketAddr
• Operator: GeoMatch
• Values: US, ZZ
• Negate condition: enabled
• Action: Block

Allowing ZZ admits all currently unmapped source addresses, not only this /22. Treat it as a temporary policy decision and retain the managed WAF rules. Microsoft recommends the negated Block pattern rather than a GeoMatch Allow action, because Allow can stop further WAF rule processing.^4^

If logs show a specific incorrect non-US country rather than ZZ, adding ZZ will not help; proceed with the correction ticket and consider a narrowly scoped IP-based exception only if the site owner accepts that temporary security trade-off.

References

1. Create an Azure support request
2. Report wrong geolocation of IP addresses in Azure/Entra-ID - Microsoft Q&A
3. Support and troubleshooting for Azure Web Application Firewall
4. Use Azure WAF geomatch custom rules to enhance network security (front-door)
5. What is geo-filtering on a domain for Azure Front Door?