country scope is huge if we only want to allow connection from specific location, as defined in Azure conditional access location.
The consequence is that we have to allow an entire country if we don't want an alerte/escalation when a user connect to office365 from a unique and known IP address (from a specific country), even if we don't want him to connecte from all other IPs from this country. So Unexpected Country feature tend to be useless.
This module should take in account Azure conditional access location, or specific IP addresses.