Entra ID Token Reuse with Correlated Impossible Travel and New Device/Client

Duo Tech@duotech

•updated Aug 5, 2026•9•0•8

Detects reuse of the same Entra ID sign-in token for the same user across two sign-ins within 60 minutes combined with impossible travel and either a new device or atypical client, excluding known corporate VPN egress and travel history.