Location Factor (Somewhere You Are).

A contextual authentication factor that uses the user's geographical or network location, such as GPS coordinates, IP geolocation or office Wi-Fi, to evaluate a sign-in. It belongs to the Identity & Access category of cybersecurity.

A contextual authentication factor that uses the user's geographical or network location, such as GPS coordinates, IP geolocation or office Wi-Fi, to evaluate a sign-in.

The location factor is a contextual signal used in modern adaptive and risk-based authentication. It can be derived from device GPS or cellular triangulation, IP-based geolocation, presence on a corporate VPN or specific Wi-Fi SSID, or even Bluetooth/UWB beacons. Identity platforms such as Microsoft Entra Conditional Access, Okta and Google evaluate the location against named locations, country lists and impossible-travel patterns to allow, step-up or block a sign-in. Location alone is not a strong factor (it can be spoofed with VPNs or GPS spoofers), so NIST treats it as supplementary; it is most useful for risk scoring and policy enforcement rather than as a primary credential.

Defences for Location Factor (Somewhere You Are) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Somewhere you are, Geolocation factor, Contextual factor.