New Contributor

What determines the location shown in MCAS for Office 365 logs other than users utilizing a VPN service on their devices? I'm seeing too many users having connections from different locations within 30 mins to an hour usually using Exchange and Sharepoint Online and this creates a lot of false positive Impossible Travel Activity alerts. How does CAS or Office 365 resolve these locations?