Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,294 questions
Atypical Travel - no info for "Previous Location"
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(86.4, 44%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EK%3C/text%3E%3C/svg%3E)
KyleG
0
Reputation points
Reviewing the output of an Atypical Travel alert, I find detailed information for "Current Location" (City, State, Country), but I only get Country as a result of the "Previous Location". Why is there a discrepancy in the amount of information I can get on both these locations?
Microsoft Sentinel
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
25,032 questions
{count} votes
-
Raja Pothuraju 23,070 Reputation points Microsoft External Staff Moderator2024-09-24T13:26:54.94+00:00 Hello @KyleG,
Thank you for posting your query on Microsoft Q&A.
As mentioned, when reviewing the risk log triggered by an atypical travel alert, you were able to find information about the current location but not the previous location’s city and state. I recommend checking the previous sign-in log, using the same timestamp and IP address, to see if the full location (city, state, and country) is displayed.
The "atypical travel" risk event is triggered by an offline detection algorithm after Identity Protection analyzes previous sign-ins. It may help to verify the user's sign-in logs around that time for any missing location details.
If the location is displayed correctly in the sign-in log but not in the risk event, I recommend contacting Support team to provide feedback on the discrepancy.
Thanks,
Raja Pothuraju. -
Raja Pothuraju 23,070 Reputation points Microsoft External Staff Moderator
2024-09-26T14:05:23.21+00:00 Hello @KyleG,
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
-
KyleG 0 Reputation points
2024-09-26T16:16:47.71+00:00 Raja,
Thank you for the response. It still doesn't explain how the info in the message can contain the country of the previous location but none of the information associated with that country. Of course, I can correlate other logs to find that information, but, since the message seems to already have that info, I'm not sure why the message can't give me all the information I need.
-
Raja Pothuraju 23,070 Reputation points Microsoft External Staff Moderator
2024-09-30T22:50:25.2+00:00 Hello @KyleG,
If you're unable to find logs that contain the country of the previous location, it’s possible that the sign-in log was triggered more than 30 days ago. Since sign-in logs are only available for 30 days, that could explain why you're unable to access the information.
Identity Protection relies on machine learning, and risk detection types take into account past sign-in history (IP, Latitude/Longitude, and ASN) to identify anomalous sign-ins. The system stores data about the locations previously used by a user and considers these "familiar" locations. A risk detection is triggered when a sign-in occurs from a location not already on the list of familiar locations.
Please verify if the user has had any recent sign-ins from the previous location. Given the discrepancy, also check if there are any other risk detections for users showing similar behavior, where only the country is mentioned for previous locations.
Thanks,
Raja Pothuraju.
Sign in to comment
Sign in to answer