Unusual Azure Resource Access from Multiple IPs/Locations

Lacey Cochrane@NullVectorX

•updated Mar 9, 2026•3•0•61

This rule detects unusual access patterns to Azure resources where a single identity (user or service principal) accesses resources from multiple distinct IP addresses and/or geographic locations within a 7-day timeframe. This behavior can indicate compromised credentials, session hijacking, or an adversary attempting to evade detection by frequently changing their apparent origin.