Impossible Travel Across Multiple Captured M365 Tokens in Tenant

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•0

Detects multiple anomalous sign-in events using the device-code authentication flow within an Entra ID tenant. The rule correlates sign-ins from geographically disparate IP addresses (often associated with known attacker infrastructure or proxies) using device-code flows, which is a technique used in 'ARToken' style phishing campaigns to compromise multiple user accounts in a short timeframe.