New Country and User Agent Sign-In
The detection looks for Entra ID sign-in events where both the source country and user agent string are new for the authenticating account(e.g., neither value has been seen during the 14-day training window (days 14–2 prior to now)). This can be changed easily in the let variable The double signal requirement is intentional. A new country alone is relatively common (VPN usage, business travel, Microsoft service IPs), and a new user agent alone is low signal (browser updates, new devices). Requiring both to be new on the same sign-in increases fidelity, while still capturing the pattern typically associated with credential compromise or account takeover. Sign-in events are collapsed to a single row per user per country, with EventStartTime and EventEndTime showing the first and last sign-in seen within the defined detection window. A dynamic risk score is applied on top of the core detection to drive alert severity so you can set noise for your environment to 'informational' and reduce SOC alert fatigue. Set the `HighRiskCountries` array to suit your risk profile
Microsoft Sentinel (KQL)
