A great way to mitigate suspicious logins is to directly deny / allow only the locations or IP address's you would like to have access to your cloud environment. Whitelisting specific locations or IP's will inherently blacklist all other locations / IP's, where as blacklisting will directly disable logins form those sources.
NOTE: To enforce policy on blacklisted logins see the Policy Guide.
STEP ONE:
Sign into your Cloud Access Monitor Instance.
STEP TWO:
Navigate to the Audit & Control Page.
STEP THREE:
Select the "Edit" pencil on your desired environment.
STEP FOUR:
Scroll to the bottom of the page, under the "Access-Rule Settings" you will find the rules for location and IP.
STEP FIVE:
Whitelisting a Location: To whitelist location simply select "Whitelist Countries" in the drop down, and then type in the location(s) you wish to allow access.
Blacklisting a Location: To blacklist a location, change the dropbox to "Blacklist Countries" and in the box below select the location(s) you would like to ban access to.
Whitelist IPs: To whitelist an IP address look to the right of the countries rule, and select "Whitelist IPs" from the dropdown, enter in the IP(s) that you would like to allow.
Blacklist IPs: To blacklist an IP select "Blacklist IPs" from the dropdown, and enter the IP address(s) that you would like to restrict access from.
STEP SIX:
Select the "Save" button on the bottom right. access rules are now complete.