Geo block enabled but approved vendor traffic also blocked

Scenario

A geo-blocking policy reduced noise, but it also broke a vendor integration that legitimately originates from blocked regions.

Recommended Resolution Path

1. Validate the source IPs and whether the vendor uses cloud ranges shared across regions.
2. Create the narrowest practical exception tied to the needed service.
3. Review whether the integration could instead use a fixed allowlisted endpoint or VPN.
4. Document the exception owner and expiry review so it does not become forgotten policy debt.

Technician Notes

Document what changed, what confirmed the fix, and whether the issue points to a broader standards gap worth addressing for the client.