# MFA empty location\_info 

**URL:** <https://community.auth0.com/t/mfa-empty-location-info/199832>\
**Category:** Get Help\
**Tags:** adaptive-mfa, mfa\
**Created:** [May 11, 2026, 8:11pm UTC](https://community.auth0.com/t/mfa-empty-location-info/199832 "2026-05-11T20:11:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sasee.venkata](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sasee.venkata/32/71203_2.png) [@sasee.venkata](https://community.auth0.com/u/sasee.venkata)\
**Post date:** [May 11, 2026, 8:11pm UTC](https://community.auth0.com/t/mfa-empty-location-info/199832/1 "2026-05-11T20:11:26Z")

</div>

Hi Auth0 Support Team,

We are integrating Auth0 Log Streams with AWS EventBridge to capture authentication and MFA events for security alerting.

We observed that the Auth0 Dashboard UI displays geolocation details such as city and country for login events under User History. However, the same events received through EventBridge/log streams contain either an empty location\_info object or no geolocation details at all.

Example:

- Dashboard UI shows:
  - IP: xxx.xxx.xxx.xxx
  - Hyderabad, India

- EventBridge payload contains:  
json “location\_info”: {}

Could you please confirm:

1. Whether geolocation enrichment is expected to be included in Log Stream/EventBridge events
2. If there is any tenant setting or configuration required to enable it
3. Whether event.request.geoip data from Actions can be propagated into exported log events

We are specifically interested in login and MFA-related events (s, f, gd\_auth\_\*).

Thanks.

---

<div class="post-metadata">

**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\
**Post date:** [May 11, 2026, 8:32pm UTC](https://community.auth0.com/t/mfa-empty-location-info/199832/3 "2026-05-11T20:32:18Z")

</div>

Hi @sasee.venkata

Welcome to the Auth0 Community

When an authentication event occurs (like an `s` for Success Login), Auth0 does two things:

1. **Real-time Streaming:** It immediately serializes the event and fires it off to configured Log Streams (like EventBridge) to ensure the lowest possible latency.
2. **Asynchronous Enrichment:** It kicks off a background task to resolve the user’s IP address against a GeoIP database.

Because Log Streams are optimized for near real-time delivery, the event payload is often dispatched _before_ the asynchronous GeoIP resolution has completed. As a result, the `location_info` object is serialized as empty in the stream. Conversely, when you view the User History in the Auth0 Dashboard, the UI queries Auth0’s indexed data store, which has had plenty of time to receive and store the enriched GeoIP data.

> **1. Is geolocation enrichment expected to be included in Log Stream/EventBridge events?**

It is included _if_ the internal GeoIP lookup completes before the stream fires, which is highly inconsistent and never guaranteed. For highly responsive streams like EventBridge, you should generally expect it to be empty or incomplete.

> **2. Is there any tenant setting or configuration required to enable it?**

No. There is no tenant-level toggle or configuration to force Auth0 to wait for the GeoIP resolution before firing the log stream. Auth0 prioritizes stream latency over enrichment completeness.

> **3. Can `event.request.geoip` from Actions be propagated into exported log events?**

No, you cannot mutate or append custom data to Auth0’s standard core log events (like `s` , `f` , or `gd_auth_*` ). The schema for these core events is immutable. Even if you access `event.request.geoip` inside a Post-Login Action, there is no `api.log.set()` method to inject that data into the primary login log payload.

If you have any other questions, let me know!

Kind Regards,  
Nik

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [May 25, 2026, 8:33pm UTC](https://community.auth0.com/t/mfa-empty-location-info/199832/4 "2026-05-25T20:33:03Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.