Glossary
Impossible travel
Two sign-ins of the same account from places too far apart for the time between them; a useful lead for account takeover, with many false positives.
Impossible travel is a detection that compares two successful sign-ins of the same account and flags them when the distance between their locations cannot be covered in the elapsed time, for example Paris and New York ten minutes apart. It suggests that someone else is using the credentials or a stolen session.
It is noisy. VPNs, cloud proxies, secure web gateways, mobile carriers and IP geolocation errors all make a user appear to jump between countries. Microsoft's Entra ID Protection equivalent, Atypical travel, learns each user's behaviour first and ignores known VPNs. The M365 Forensics rule flags consecutive successful sign-ins at least 500 km apart implying more than 900 km/h, rated high but not critical.