Fix "Access was blocked because my location looked unusual"

TL;DR — This block usually means your Zero Trust access policy saw your sign-in come from a country, city, IP address, or network it did not expect. The fastest fix is to retry from a normal network first (turn off VPN/proxy, switch off mobile data, reconnect on your usual Wi‑Fi), then have an admin review the access log entry and update the allowlist or trusted location rule if the block was legitimate. Reading time: ~6 min

The scenario

It is a normal Tuesday afternoon and you are trying to open your company app, admin panel, or VPN-protected site. Instead of the login finishing, you get a message saying your access was blocked because your location looked unusual. You might be at home, on hotel Wi‑Fi, tethered to your phone, or using a VPN (virtual private network). Nothing else seems broken, but you cannot get into the one system you need right now.

Symptoms

• You see a block page or login error such as:

  Access was blocked because your location looked unusual.
  

• Common variants include:

  Sign-in blocked due to unusual location
  

  Access denied: location not allowed
  

  Your request was blocked by an access policy
  

• You can reach the site, but after login or during single sign-on (SSO, one login for many apps), access is denied.
• The same account works from one network but fails from another.
• Admin or audit logs show entries like:

  decision=deny reason=geo_location_mismatch
  

  policy=trusted-locations action=block
  

  source_ip=203.0.113.24 country=DE expected_country=US
  

• You recently changed one of these:
  • turned on a VPN or proxy
  • switched from office/home Wi‑Fi to mobile data
  • traveled to another city or country
  • got a new ISP (internet service provider)

Likely causes

Step-by-step diagnosis

1. Check your current public IP and visible location.

   • Open your browser and visit:

   https://ifconfig.me
   

   • If the IP or country shown is not where you physically are, this is likely a VPN/proxy/mobile-routing issue. Jump to Fixes → VPN or proxy changed your apparent location or Fixes → Mobile carrier or ISP routed traffic through another city/country.

2. Retry from a normal network.

   • On your device, turn off any VPN app, privacy relay, or proxy. Then disconnect from mobile data and reconnect to your usual home or office Wi‑Fi.
   • If the login works on usual Wi‑Fi but not on mobile/hotel/VPN, this is your problem. Jump to the matching fix section.

3. Check whether the block is policy-based.

   • Ask an admin to open your provider's dashboard and go to the access or security event logs. In many providers this is under a path like:

   Security/Access → Logs
   

   • Find the latest deny event for your username or source IP.
   • If you see geo_location_mismatch, country_not_allowed, ip_not_in_allowlist, or a named policy like trusted-locations, jump to Fixes → Your Zero Trust policy only allows specific countries, IPs, or office egress addresses.

4. Confirm whether you are simply in a new place.

   • Compare your current public IP from https://ifconfig.me with the list of approved office/home/trusted IPs your admin keeps.
   • If your IP is new and you are traveling or working somewhere new, jump to Fixes → You are traveling or working from a new location not yet approved.

5. Check for bad geolocation data.

   • Open:

   https://ipinfo.io/<your-ip>
   

   • Replace <your-ip> with the IP from step 1.
   • If the country or city is clearly wrong, jump to Fixes → IP geolocation data is wrong or stale.

6. Check whether your office or company egress IP changed.

   • From the affected office network, open:

   https://ifconfig.me
   

   • Compare that IP with the one in your access policy or internal documentation.
   • If they differ, jump to Fixes → Corporate NAT or egress IP changed and the allowlist was not updated.

[Your Device] ---- 1. login ----> [Access Policy]
     |                                  |
     | 2. source IP / country           | 3. evaluate trusted
     v                                  v
[Public IP] ------------------------> [Rules]
                                         |
                         4. deny unusual v
                                    [Block Page]

Fixes

VPN or proxy changed your apparent location

1. Turn off your VPN, proxy, or privacy relay in the app you use.
2. Reconnect your browser and retry login.
3. If you must use a VPN for work, ask your admin to allow the VPN egress IP instead of your home IP.
   • Give them your current public IP from:

   https://ifconfig.me
   

4. If your browser has a manual proxy configured, remove it.
   • On Windows: Settings → Network & Internet → Proxy
   • On macOS: System Settings → Network → Wi‑Fi/Ethernet → Details → Proxies

Verify it worked: log in again from the same device with VPN/proxy off and confirm the block page no longer appears.

Mobile carrier or ISP routed traffic through another city/country

1. Switch off mobile data and connect to your usual Wi‑Fi.
2. Retry the login.
3. If you must use mobile data, send your current public IP to an admin so they can review whether it should be temporarily allowed.
4. If this happens often on home internet, reboot your router once to obtain a fresh public IP.

⚠️ Rebooting a router can interrupt calls, meetings, and any devices using that connection for a few minutes.

Verify it worked: after switching networks, https://ifconfig.me shows a different IP and the login succeeds.

Your Zero Trust policy only allows specific countries, IPs, or office egress addresses

1. Have an admin open the access policy in your provider dashboard. Look for a path like:

   Security/Access → Applications → <your app> → Policies
   

2. Review rules for:
   • allowed countries
   • IP allowlists
   • trusted network ranges in CIDR (IP range notation)
   • office egress IPs
3. Update the rule to include the legitimate location or IP.
   • Example allowlist entry for a single IP:

   203.0.113.24/32
   

   • Example allowlist entry for a small office range:

   203.0.113.0/24
   

4. Save the policy and ask the user to retry.

⚠️ Broadening an allowlist can weaken security. Add the smallest possible IP range, and prefer a temporary exception with an expiry if your provider supports it.

Verify it worked: the next access log entry changes from deny to allow for the same user and source IP.

You are traveling or working from a new location not yet approved

1. Send your admin these two items:
   • your public IP from https://ifconfig.me
   • the country/city you are physically in
2. Ask for a temporary exception in the access policy for your current IP or country.
3. If your provider supports device posture or MFA (multi-factor authentication), ask the admin to require that too, instead of opening access broadly.
4. Once you return, have the temporary exception removed.

Verify it worked: you can log in from the travel network, and the access log shows your exception rule matched.

IP geolocation data is wrong or stale

1. Confirm the wrong location using:

   https://ipinfo.io/<your-ip>
   

2. As a short-term workaround, ask your admin to allow your exact IP instead of relying only on country matching.
   • Example single-IP allowlist entry:

   198.51.100.42/32
   

3. Ask your ISP to correct the IP geolocation with major geolocation providers. This is usually done through the ISP's support channel.
4. If possible, reconnect your router to obtain a different IP and test again.

Verify it worked: the IP lookup now shows the expected country, or the exact-IP allowlist lets you in without changing the country rule.

Corporate NAT or egress IP changed and the allowlist was not updated

1. From the office network, get the current public IP:

   https://ifconfig.me
   

2. Compare it to the trusted office IP in your access policy or documentation.
3. Update the allowlist in the provider dashboard to the new egress IP.
   • Example:

   old: 203.0.113.10/32
   new: 203.0.113.77/32
   

4. If your ISP changes office IPs regularly, ask them for a static IP (fixed public IP) or move the policy to a VPN egress with a stable IP.

Verify it worked: users on the office network can log in again, and the access log shows the new office IP as allowed.

Prevention

• Add an access-log alert for location-based denies so you know before users open tickets. Export security logs to your log tool and alert on patterns like:

  {"decision":"deny","reason":"geo_location_mismatch"}
  

• Keep a documented list of trusted egress IPs for office, VPN, and remote admin networks. Store it in version control and review it after ISP or firewall changes:

  {"office_ips":["203.0.113.77/32"],"vpn_ips":["198.51.100.10/32"]}
  

• Prefer exact IP or device-based trust over country-only rules for admins and contractors. Country checks are useful, but mobile carriers and VPNs make them noisy.
• Add a quarterly test from each trusted network: open https://ifconfig.me, compare it to the documented allowlist, and record the result.
• If you manage policies as code, pin trusted ranges in config and review changes in pull requests:

  {"allow":["203.0.113.77/32","198.51.100.10/32"],"require_mfa":true}
  

• For traveling staff, create a temporary-access process with expiry so support does not have to widen permanent rules during urgent incidents.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.