Correction to my post - we do have AzureAD.
The answer is yes, you get ClientIP and can iplocation that value to get Country.
Following the steps was fairly straightforward, but the documentation is a bit behind the current interface meaning the specific steps and screenshots don't always match (Microsoft).
One more catch - the Splunk input setup may not allow you to select the index you want to use, I just edited the inputs.conf file for what I wanted.
