Service Account Login from External or Anomalous Source IPs

Ankit Mehta@Secvyn

•updated Jun 27, 2026•1•0•3

Detects successful authentication events from accounts identified as service, managed, or robot accounts (e.g., svc_, sa_, msol, robot) originating from external IP addresses or exhibiting an unusually high number of distinct source IP addresses. This behavior is indicative of potential credential theft, token replay attacks, or unauthorized usage of service account identities.