Impossible Travel: Azure AD Successful Logins from Multiple Countries in 10 Min
Detects Microsoft Entra ID (formerly Azure AD) sign-in logs where a single user account authenticates from two different countries within a 10-minute window, which is indicative of potential account compromise or credential sharing.
Splunk (SPL)

