That is a GREAT question! Does it look like this?:
Apple Authenticates a little differently with Exchange Servers.
As a deference to you being in charge of your own device they want you to notice that they can tell that the account(s) you are accessing are 'cloud' Exchange Accounts (not a server sitting in your room, at the school, etc.) so the "location" report it gets every time it signs in "shifts" a little. (Of course, it does so because you are not on only one server 'in the cloud' you are on dozens!)
This is appropriate to approve and tell it to "always use my response for this server."
All you are saying is, "Oh, yeah, I know that Apple, let that behavior from the cloud Exchange be one you remember is 'safe;' I meant to do that!"
So, it is good behavior to always deny changes or queries if you don't know what they are doing but, now you know about this one; so you can change this one.