Geo blocking rejects sign-in and sign-up when the request comes from a country you have marked. It is a country list, not a fraud score. A user on a VPN in an allowed country still gets through. A user at home in a blocked country does not.

## Block a country

1. Open the [console](https://console.authdog.com) and select the environment.
2. Go to **Authentication > Policies > Countries**.
3. Click countries on the map. The selection is amber.
4. Open **Review & confirm** to add them as blocked. Blocked countries turn red.
5. Click a red country to remove it. **Clear all** drops the list.

Sign-in and sign-up from a blocked country fail with "Sign-in is not available from your country." An empty list blocks nobody. Saving a list enables the policy.

The country comes from the edge (`cf-ipcountry`). **Unknown networks** covers Cloudflare `XX` (unknown) and `T1` (Tor). They are not countries, so a pin on the map does not match them. Set **Unknown networks** on the same tab:

| Setting | What happens |
| --- | --- |
| **Allow** | Those requests continue. This is the default. |
| **Challenge when a CAPTCHA is on** | The request continues only after the environment CAPTCHA accepts it. With no CAPTCHA configured, the request is denied. |
| **Deny** | Sign-in and sign-up fail with "Sign-in is not available from this network." |

A hosting provider or VPN in an allowed country still looks like that country. Pair this list with [bot detection](/docs/secure/attack-protection) when the exit node is the problem.

## What it does not do

- It does not sign out a session that was issued before you blocked the country. Shorten [token lifetime](/docs/secure/session-security) if a block must take effect quickly for people already signed in.
- It does not replace an email allowlist. A contractor in an allowed country with a personal domain is an [access control](/docs/secure/access-control) problem.
- It does not follow the user after they connect through an exit node somewhere else. Pair it with [device risk](/docs/secure/attack-protection) if impossible travel matters.

Test from a network you expect to block before you rely on the list. A wrong click on a large country locks out everyone there, including you, if you are deploying from that country.

## Related

| Read | To learn how to |
| --- | --- |
| [Attack protection](/docs/secure/attack-protection) | Bots, lockout, and device risk |
| [Access control](/docs/secure/access-control) | Who may create an account |
| [Session security](/docs/secure/session-security) | How fast an existing session expires |
| [Authentication](/docs/console/authentication) | Where the Policies tab sits |