Field guide / Reviewed October 31, 2026
A location change is a lead.
Start with what the authentication record says happened. Then ask whether the account, device and subsequent activity support the same story.
Read more than the country label.
Microsoft Entra sign-in details include contextual fields and authentication information. IP-derived location is a best-effort estimate. Do not treat a mapped location as proof of a person's physical location. Microsoft sign-in activity details.
For this scenario, collect a reference to the original record and write down the sign-in result, application, sign-in type, authentication details and policy result. Compare account and device context using telemetry you are allowed to access. Record where details are unavailable.
Ask questions that distinguish explanations.
- Expected network change? Verify approved VPN or travel context through your team's trusted records and contact process.
- Expected device change? Compare the captured device information with asset records. Missing device details do not prove an unmanaged device.
- Account activity after sign-in? Search available application and identity audit sources with an explicit window. Preserve correlation limits.
- Authentication actually satisfied? Read the detailed outcome. Avoid reducing a multi-step authentication record to a single reassuring label.
These are investigation questions, not a score. A benign explanation becomes useful when evidence supports it.
Worked synthetic note.
E1 / 09:12 UTC / training event S1: The record reports a successful sign-in for user-07 to the training application. No device context is supplied.
E2 / 09:14 UTC / training event A1: A profile-setting read is recorded for user-07. A shared session identifier is not supplied.
Interpretation: The two records involve the same account. That does not establish they belong to the same session or person.
Handoff question: “Can the identity owner establish device context, verify expected activity through the approved contact channel, and correlate the sign-in with the application audit record?”
Escalate the uncertainty that matters.
An unrecognized successful sign-in, sensitive account, concerning downstream change or inability to collect essential records may warrant escalation under your local policy. The worksheet cannot establish your organization's severity, containment authority or deadline. State the question and intended owner.
Do not close solely because a public IP lookup looks clean, a user offers an explanation, or no downstream events were supplied. Each of those observations has a narrower meaning than “safe.”
Open the suspicious-sign-in worksheet. Select the synthetic example to practice writing the handoff.