Impossible Traveler – Cross-Country Sign-ins with Device Mismatch
Detects successful Microsoft Entra ID sign-ins originating from geographically distant locations within a short time period where the calculated travel speed exceeds realistic human travel limits (>900 km/h). The detection correlates consecutive sign-ins for the same user and identifies potential account compromise by validating device identifiers and trust attributes. Alerts are generated when a user authenticates from different countries, exceeds configured distance and speed thresholds, and uses a different or unknown device.
Microsoft Sentinel (KQL)
