Threat Hunt: Impossible Travel Detection for Azure Logins

Aamir Muhammad@Aamir

•updated Mar 25, 2026•3•0•102

This rule detects impossible travel scenarios for Azure logins by calculating the speed required to travel between two consecutive login locations for the same user. It flags logins where the calculated speed exceeds the maximum speed of a commercial passenger aircraft (900 km/h) and the logins originate from different countries. Mobile device logins are excluded to reduce false positives related to VPN usage.