Identity alerts have the highest false-positive surface area of any class. VPNs cause impossible travel. Travel causes impossible travel. MFA push fatigue is rare but real. The identity playbook teaches you to distinguish these cases with evidence rather than assumption.
The Identity Pivot Chain
Identity alert fires
│
├─► User account: role, department, MFA enrollment, admin status
│
├─► Authentication location: IP geolocation, ASN, is it VPN/Tor?
│
├─► Authentication method: modern vs legacy? MFA success/deny/bypass?
│
├─► Prior auth locations: 30-day history — is this country new?
│
├─► Impossible travel calculation (if multi-location)
│
├─► What happened after successful auth: resource access, mail rules?
│
└─► Lateral scope: did this credential appear on other hosts?Step 3: Authentication Method — Modern vs Legacy
Entra ID sign-in log fields to check:
clientAppUsed: Modern browsers show “Browser” or specific app names. Legacy protocols show “SMTP”, “IMAP”, “POP3”, “Exchange ActiveSync”authenticationMethodsUsed: blank or single-factor on what should be an MFA-enforced account = bypassriskLevel+riskEventType: Microsoft’s risk signals (impossible travel, anomalous IP, leaked credentials)conditionalAccessStatus: “success” = CA passed; “failure” = CA blocked it
Step 4–5: Impossible Travel Investigation
Before concluding impossible travel, verify:
- Does the user have a VPN? VPN exit nodes produce geolocation mismatches. If your org uses a VPN, check the IP against the VPN’s exit IP range.
- Is the IP a corporate proxy? Split-tunnel VPNs route web traffic through a local proxy that may appear as a foreign IP.
- Is the IP a Tor exit node or anonymizing service? VirusTotal, AbuseIPDB, or IPinfo AS description will show this.
- Is there a documented business trip? Check with HR or the user’s manager before concluding compromise.
Only after clearing these: compute the travel time vs distance.
import geopy.distance
loc1 = (40.7128, -74.0060) # New York
loc2 = (51.5074, -0.1278) # London
distance_km = geopy.distance.distance(loc1, loc2).km # ~5,570 km
time_between_auths = 45 # minutes
speed_required_kph = (distance_km / time_between_auths) * 60 # ~7,427 kph
# Maximum commercial aircraft speed: ~950 kph
# 7,427 kph is not physically possible. This is impossible travel.MFA Push Fatigue Pattern
What to look for in logs:
- Repeated MFA denials from the same account in a short window (3+ denials in 15 minutes)
- Followed by a single MFA approval
- Authentication IP is new (not a known device or location)
- Access to sensitive resources immediately after
In Entra ID sign-in logs:
userPrincipalName: cfo@corp.com
authenticationRequirement: multiFactorAuthentication
status.failureReason: MFA denied (user pressed deny)
[repeated 4 times]
status.failureReason: MFA completed successfully
[followed by mail access, SharePoint access, OneDrive access]Escalate as TP. The pattern (multiple denies → one approve → immediate resource access) is diagnostic.
OAuth Consent Grant Investigation
In Entra ID Audit Log, look for:
- Operation:
Consent to application targetResources.displayName: unusual app name (not a known enterprise app)targetResources.modifiedProperties[].oldValue = []→ first grant ever- Permissions granted:
mail.read,files.readwrite,calendars.readwriteare high-value
Red flags:
- App registered within 7 days of the grant
- Publisher not verified
- Permissions include
offline_access(persistent token) +mail.read - Multiple users in same org consented on same day (phishing campaign)
Why it’s dangerous: OAuth tokens survive password resets. Revoking sessions doesn’t revoke the OAuth grant. The remediation requires explicit revocation of the OAuth token in the admin portal.
Microsoft Entra Identity Protection Risk Events— Microsoft Learn