1 min read
Detecting unusual sign-ins in Microsoft 365
Impossible travel, new countries, and legacy protocol spikes: signals worth a human look.
Sign-in logs are how you notice account takeover early.
Watch for
- Successful sign-ins from odd countries relative to your staff
- Floods of failed then successful MFA prompts
- Sudden use of legacy protocols you thought you blocked
- New MFA methods added to an account
Response
Contain first (disable/reset), then investigate. Do not only “monitor.”
We can help configure alerts suited to a small tenant. contact Qutzl.