Anomalous Azure AD device-code sign-in with travel/captive-portal proximity
Detects Azure AD sign-ins using the OAuth device code authentication flow that are followed by impossible-travel patterns (country change within a short window) or that occur near captive-portal network connections on the same device, consistent with Midnight Blizzard's CaptiveCrunch device-code phishing tradecraft targeting corporate travelers.
Microsoft Sentinel (KQL)
