AAD Impossible Travel: Single User Auth from 3+ Countries Within 1 Hour
Detects user sign-in activity originating from more than two distinct countries within the same hour, which is often indicative of impossible travel or compromised credentials.
Microsoft Sentinel (KQL)
