At-Risk User Copilot Activity with Multi-Location Unmanaged Device Sign-ins
Detects Entra ID users with active medium-to-high identity risk events who perform Microsoft Copilot actions in cloud applications while simultaneously exhibiting impossible travel indicators — successful sign-ins from multiple geographic locations using unmanaged (non-registered) devices within a one-hour window. This triple-signal correlation (identity risk + impossible travel on unmanaged device + Copilot usage) is a strong indicator of account compromise where an adversary has taken over a legitimate identity and is leveraging AI-powered tools to accelerate reconnaissance, data access, or exfiltration against Microsoft 365 resources.
Microsoft Sentinel (KQL)
