If you've blocked sign-ins from outside the U.S. in Microsoft 365, good. Just know what that control actually does.
Most firms I talk to think of geo-blocking as a wall. It's closer to a tripwire.
Here's why. Microsoft decides which country you're signing in from by looking at your IP address. Run that traffic through a commercial VPN with an endpoint in Miami and the sign-in looks like Miami. Microsoft says as much in its own documentation: when a hosted proxy or VPN is in the path, the address being evaluated is the proxy's, and the header carrying the real one isn't trusted, because it can be faked.
So the attacker who phished one of your advisors last Tuesday doesn't show up in Belarus. He shows up in Boca.
The travel-anomaly detections — two sign-ins too far apart for the same person to have made both — are better, and genuinely worth having. But they tell you something already happened. They don't stop it.
What closes the door is making a stolen password useless: passkeys or hardware keys instead of texted codes, legacy sign-in methods switched off, and a policy that actually reacts to a risky sign-in rather than just logging it.
Keep the geo-block. Just don't let it be what you're counting on the morning a wire is about to go out.
Worth a look before your next cyber renewal.
Want the next one in your inbox?
One practical Microsoft 365, Copilot, Azure, or security move per week — plain English, no pitch.
Subscribe via email