Back to script library
Entra / Microsoft 365 · Users & guests

Get IP geolocation

Query the IP-API endpoint to retrieve geolocation information for an IP address, useful for enriching Microsoft 365 audit record data.

Connect & set up

Run these once per session. All scopes are read-only unless the script makes changes.

# Review required modules and connection steps before running.
# Connect to Microsoft Graph or Exchange Online as needed for this script.

Run it

The main script. Copy it, or download the .ps1 and run it from your console.

function Get-IPGeolocation {
Param ([string]$IPAddress)
$IPInfo = Invoke-RestMethod -Method Get -Uri "http://ip-api.com/json/$IPAddress"
[PSCustomObject]@{
IP = $IPInfo.Query
City = $IPInfo.City
Country = $IPInfo.Country
Region = $IPInfo.Region
Isp = $IPInfo.Isp }
}
Attribution