During a Microsoft 365 or Microsoft Entra sign-in, users may occasionally see the following message:
Share your location from your Microsoft Authenticator app
This message is not the normal location information displayed in an MFA notification. It appears when Microsoft Entra Conditional Access needs the mobile device’s GPS coordinates to determine whether the user is signing in from an approved country or region.
In this blog, I will demonstrate a practical scenario using a single Conditional Access policy.
The Actual Scenario
Consider an organization that wants administrators to access Microsoft administration portals only when they are physically located in Bahrain.
To implement this requirement, the administrator creates:
- A country-based Named Location that determines the user’s location using GPS coordinates.
- A Conditional Access policy that blocks access from all locations except the GPS-verified Bahrain location.
The important point is that Microsoft Entra cannot obtain GPS coordinates directly from the Windows device or browser.
The GPS coordinates must be provided by the user’s registered Microsoft Authenticator app.
During the initial sign-in, Microsoft Authenticator has not yet shared the device location. Microsoft Entra therefore cannot confirm that the user is inside Bahrain.
This is when the sign-in page asks the user to enable location in Microsoft Authenticator.
Step 1: Create a GPS-Based Named Location
Open the Microsoft Entra admin center and navigate to:
Entra ID → Conditional Access → Named locations
Create a new country-based location with the following settings:
- Name: Bahrain-GPS-Verified Location
- Determine location by: GPS coordinates
- Country or region: Bahrain
Save the Named Location.
This setting is the main reason Microsoft Authenticator becomes involved in the sign-in process.
When GPS coordinates are selected, Microsoft Entra expects the user’s registered Microsoft Authenticator app to provide the physical location of the mobile device.
Step 2: Create the Conditional Access Policy
Navigate to:
Entra ID → Conditional Access → Policies → New policy
Configure the policy as follows.
Policy name
CA010 – Block Admin Portal Access Outside Bahrain
Users
- A pilot administrator
- Or a dedicated test group
- Emergency access accounts
Target resources
For initial testing, you may use a less critical cloud application.
Network condition
Exclude: Bahrain-GPS-Verified Location
Access control
The policy logic is: Block access from every location except the GPS-verified Bahrain Named Location.
What Happens During the First Sign-In?
The pilot user now attempts to access the Microsoft Entra admin center.
Conditional Access policy evaluates the sign-in and finds that the policy requires the user to be inside the Bahrain GPS-based Named Location.
However, at this point, Microsoft Authenticator has not provided any GPS coordinates.
Microsoft Entra therefore cannot determine whether the user is:
- Inside Bahrain
- Outside Bahrain
- Or refusing to share their location
Because the location requirement has not been satisfied, the Microsoft sign-in page displays a message , Share your location from your Authenticator app
The screenshot below shows the user sign-in experience without MFA enforcement.
The screenshot below shows the user sign-in prompt with MFA enforcement enabled.
This does not necessarily mean that the user is outside the approved country.
It initially means that Microsoft Entra has not received the GPS coordinates required to evaluate the Conditional Access policy.
User Action in Microsoft Authenticator
The user must open Microsoft Authenticator and complete the location request.
Depending on the mobile OS, the user may need to allow:
- Precise location
- Location access while using the app
- Background location access
- Authenticator notifications
A user signing in without MFA will see the screen below when GPS coordinates are required to evaluate the Conditional Access policy.
For users with MFA enabled, the standard Microsoft Authenticator number-matching prompt will be displayed.
Once the user selects Approve, if GPS is disabled or the required location permissions have not been granted to the Microsoft Authenticator app, the permission error shown below will appear.
Make sure Location Access is set to Allow all the time to continue with the authentication request.
After the user grants permission, Microsoft Authenticator obtains the mobile device’s GPS coordinates and sends the location information to Microsoft Entra.
Conditional Access then evaluates whether the detected country or region matches the Bahrain Named Location.
For the next 24 hours, if the user continues to access the protected resource and Microsoft Authenticator has permission to run in the background, the device location is shared silently approximately once every hour.
After 24 hours, the user must open Microsoft Authenticator again and approve the location request.
Each time the GPS location is shared, Microsoft Authenticator also performs jailbreak/root detection using logic similar to the Microsoft Intune MAM SDK. If the device is detected as jailbroken or rooted, the location is considered invalid and access to the resource is denied.
On Android devices, Microsoft Authenticator uses the Google Play Integrity API to perform this device integrity check. If the Google Play Integrity API is unavailable, the request is denied and the user cannot access the protected resource while the Conditional Access policy remains enforced.
Users can alter or spoof the GPS location reported by iOS and Android devices. To help prevent location-based Conditional Access policies from being bypassed, Microsoft Authenticator can deny authentication when the reported location appears to differ from the device’s actual GPS location.
The following error is displayed in the Microsoft Authenticator app when location manipulation is detected. In the example below, I used a GPS spoofing app and Android Developer Options to change the device’s reported GPS location.
If location manipulation is detected, the GPS location is considered invalid and the user is denied access to the protected resource.
The following error screen will be displayed on the Microsoft sign-in page.
Expected Results
The result depends on the GPS information received from Microsoft Authenticator.
| Condition | Expected result |
|---|---|
| No GPS coordinates have been provided | User is asked to enable location in Authenticator |
| GPS confirms that the mobile device is in Bahrain | Access is allowed |
| GPS shows that the mobile device is outside Bahrain | Access is blocked |
| User denies location permission | Location cannot be verified and access may be blocked |
| Background location permission is unavailable | The user may receive additional location prompts |
| GPS manipulation is detected | Location validation may fail, Sign-in Request will be denied |
The initial prompt is part of the expected Conditional Access flow. It appears because the policy requires GPS validation and the required coordinates are not yet available.
Validate the Result in Sign-In Logs
To identify the Conditional Access policy that triggered the request
In the Microsoft Entra admin center, you can review sign-in logs under Entra ID → Monitoring & health → Sign-in logs or directly from the Conditional Access section.
Open the affected sign-in and review the Activity details
Look for:
- Location Tab
- Conditional Access Tab and Location Based CA Policy
The Location tab shows the named location as Bahrain Based – GPS Verified Location, which is the same location excluded from our Conditional Access policy. Since Microsoft Authenticator identifies the user’s GPS location as BH (Bahrain), this sign-in matches the excluded named location. therefore access is not blocked by the policy.
Why Is the Mobile Phone Location Used?
The user may be signing in from a Windows computer, but the browser cannot provide the trusted GPS signal required by this Conditional Access configuration.
So Microsoft Entra uses the registered Microsoft Authenticator app on the user’s mobile device as the source of the GPS location.
This means the policy is validating the location of the mobile device running Microsoft Authenticator.
Using the same Conditional Access policy scenario, let me test a sign-in to the Azure portal from the Netherlands using a browser, while my registered Microsoft Authenticator device remains in Bahrain.
When I attempt the sign-in from the Netherlands, the browser session originates from a Netherlands IP address. However, because the Conditional Access policy is configured to use a GPS-based Named Location, Microsoft Entra requests the location from Microsoft Authenticator.
Once I approve the request from my Authenticator device in Bahrain, Microsoft Entra receives the GPS location of the Authenticator device and identifies it as Bahrain.
Since Bahrain is the location excluded from the Conditional Access block policy, the sign-in is allowed, even though the browser session itself originated from the Netherlands.
This can look confusing in the sign-in logs. The sign-in location based on the browser's public IP may still show Netherlands, while the Conditional Access policy evaluation can show the Network condition as "Location excluded."
At first glance, this may appear as though the Netherlands was excluded from the policy. In reality, the exclusion was satisfied because the GPS location reported by Microsoft Authenticator was Bahrain, which is the Named Location excluded from the Conditional Access policy.
This is an important behavior to understand with GPS-based Conditional Access: the location used for the policy evaluation can come from Microsoft Authenticator rather than the IP location of the browser session.
For the best result, the user and the registered mobile device should be in the same physical location when the policy is evaluated.
Do Not Confuse GPS Validation with MFA Location Context
Microsoft Authenticator may normally display a city or country during an MFA approval request.
For example: Microsoft 365 ,Manama, Bahrain
That location is generally derived from the public IP address of the sign-in and is displayed to provide additional context to the user.
The message asking the user to enable location in Microsoft Authenticator is different.
It means that Microsoft Entra requires actual GPS-based location information to complete a Conditional Access policy evaluation.
Report-Only Policies Can Also Trigger the Prompt
A particularly important point is that a GPS-based Conditional Access policy in Report-only mode may still request location information from the user.
Although Report-only mode does not enforce the final block or grant decision in the same way as an enabled policy, Microsoft Entra still needs the GPS information to calculate what the policy result would have been.
Therefore, users may see the location prompt even when the policy is configured only for testing.
When troubleshooting an unexpected location request, review both:
- Enabled Conditional Access policies
- Report-only Conditional Access policies
Important Considerations
- GPS-based location can also be used with passwordless phone sign-in, but MFA push notifications must also be enabled.
- A user can sign in using Microsoft Authenticator passwordless phone sign-in, but when Microsoft Entra needs to validate the user's GPS location, the user must still approve a subsequent MFA push notification so that Authenticator can provide the required location information.
- GPS-based location validation does not work when the user is configured to use only passwordless authentication methods that do not support the required Authenticator push interaction.
- Another point to consider is that multiple Conditional Access policies may be evaluated during the same sign-in. Microsoft Entra might request the user's GPS location as part of one policy, but successfully passing the location check does not automatically mean the sign-in will be allowed. For example, the user may successfully satisfy the GPS-based location requirement but still be blocked because another Conditional Access policy requires a compliant device, a specific authentication strength, or another control that has not been satisfied.
User Experience Impact
- Administrators should also carefully consider the user experience before deploying GPS-based location controls broadly.
- Users may receive notifications approximately once every hour informing them that Microsoft Entra is checking their location through Microsoft Authenticator. For this reason, GPS-based Conditional Access is best suited for highly sensitive applications, privileged access, or scenarios where access must be restricted to a specific country or region and the additional user interaction is acceptable.
It is generally not something that should be applied broadly across all applications without first considering the operational and user-experience impact.
Conclusion
GPS-based Conditional Access adds an extra layer of location validation by using Microsoft Authenticator to confirm the user’s physical location, rather than relying only on the sign-in IP address.
It can be very useful for protecting sensitive applications or enforcing country-specific access requirements, but it should be deployed carefully due to the additional prompts and user experience impact.
The key takeaway is simple: the location used for Conditional Access evaluation may come from Microsoft Authenticator, not necessarily from the browser or device where the sign-in originates.
0 Comments