Entra ID Sign-in Succeeds Despite Anonymized/Risky IP Flag (AiTM Proxy Geo-Match

Ankit Mehta@Secvyn

•updated 29 days ago•1•0•2

Detects successful Entra ID authentication events where the user login originated from an anonymized or malicious IP address, or exhibited unfamiliar features, despite successfully completing multi-factor authentication (MFA). This pattern is consistent with adversary-in-the-middle (AiTM) phishing attacks, where a proxy service is used to intercept and bypass MFA controls.