Impossible travel in Microsoft 365 explained

A staff member logs into Microsoft 365 from Brisbane at 9am. Two hours later, the same account logs in from the United States. That is physically impossible, so something is wrong. This is what the security industry calls “impossible travel”, and Microsoft 365 has built-in tools to catch it before damage is done.

If you manage a team or run a business, understanding how this protection works, and whether your current licence covers it, is worth a few minutes of your time. Our IT consulting team at Think Technology Australia gets questions about this regularly, especially after clients have a near-miss with a compromised account.

What is impossible travel?

Impossible travel is a security alert triggered when the same user account logs in from two locations that are too far apart to reach in the time between sign-ins. The logic is simple: if someone signs in from Sydney and then signs in from Eastern Europe thirty minutes later, one of those sessions is not the real user.

The most common cause is a phishing email. A staff member clicks a convincing fake link, enters their Microsoft 365 username and password, and an attacker in another country has the credentials within seconds. They log in immediately. The real user is still at their desk, unaware anything happened.

Business email compromise often follows. Once inside a mailbox, attackers look for payment-related emails, create forwarding rules to hide their activity, and may respond to suppliers or clients while the legitimate user sees nothing. The business email compromise risks are real and costly.

How Microsoft 365 detects impossible travel

Detection runs across two layers in the Microsoft security stack.

The first is Microsoft Entra ID Protection (formerly Azure Active Directory). This examines every sign-in in real time and scores it for risk. An impossible travel event, where two geographically distant sign-ins occur within a timeframe too short for legitimate travel, is flagged as a medium-to-high risk sign-in. The algorithm considers the time between sign-ins, the distance between locations, and whether either location is typical for that user.

The second is Microsoft Defender for Cloud Appswhich is part of the broader Microsoft Defender XDR (Extended Detection and Response) platform. This tool analyses sign-in data from Entra ID and Microsoft 365, then surfaces impossible travel as a named anomaly detection alert. Administrators can view and manage these alerts under Cloud Apps in the Microsoft Defender portal.

From June 2025, Microsoft transitioned Defender for Cloud Apps anomaly detection to a dynamic threat detection model. The system now adapts its detection logic automatically as the threat landscape changes, rather than relying on static policies. This means your protection stays current without manual policy updates.

The system also has a learning period. It takes up to 14 days or 10 sign-ins to build a baseline for each new user before anomaly alerts become reliable. During that window, some detections may not fire as expected.

What happens when an alert fires

When an impossible travel event is detected, the response depends on how your environment is configured. At a minimum, your IT administrator receives an alert in the Microsoft Defender portal with details including the user identity, timestamps, source IP addresses, and geolocations of both sign-ins.

With cloud app security policies in place, the response can be automated. A Conditional Access policy set to trigger on medium or high sign-in risk can block access immediately, force a multi-factor authentication (MFA) prompt, or require a password reset before the session continues. This stops an attacker in their tracks even if the alert is not reviewed straight away.

The administrator then investigates. They check whether the user was actually travelling, confirm or dismiss the risk, and revoke active sessions if the sign-in is confirmed as a compromise.

Which Microsoft 365 licence do you need?

This is where it gets important for Australian SMEs to understand what they actually have.

• Microsoft 365 Business Premium includes Microsoft Entra ID P1. This gives you Conditional Access policies, which you can use to respond to sign-in risk signals. However, full risk-based impossible travel detection through Entra ID Protection requires Entra ID P2.
• Microsoft 365 E5 (and the Microsoft Defender for Cloud Apps standalone add-on) includes the complete impossible travel anomaly detection stack, including Entra ID P2 and Defender for Cloud Apps. This is where the named impossible travel alert is fully active.
• Microsoft 365 Business Standard and below include only Entra ID Free. There is no Conditional Access, no risk-based policies, and no impossible travel detection at all.

If you are unsure which plan your organisation is on or whether your policies are correctly configured, this is worth checking. A gap in your identity protection is one of the more common issues we find during IT security audits.

How Single Sign-On extends the protection

At Think Technology Australia, we take this further by setting up Single Sign-On (SSO) for our clients. SSO means your staff use their Microsoft 365 account to log in to other business tools, such as Dropbox, rather than separate usernames and passwords for each app.

The security benefit is significant. Because authentication routes through Microsoft Entra ID, impossible travel protection applies to all connected apps, even those that have no native security monitoring of their own. A suspicious login to Dropbox via SSO is treated the same as a suspicious login to Microsoft 365 directly. The same risk signals fire, the same Conditional Access policies apply, and the same alert lands on your administrator’s screen.

You can read more about our Dropbox integration and how it fits within a managed Microsoft 365 environment.

See it in action

Our Operations Director Mungo Bright recorded a walkthrough showing how impossible travel alerts appear inside Microsoft Defender for Cloud Apps. If you want to understand what this looks like behind the scenes in a real Microsoft 365 tenant, this is the clearest way to see it.

A quick checklist for Brisbane SMEs

Not sure where your business stands? These are the questions worth asking:

• Are all staff using Microsoft 365 Business Premium or higher? (Anything lower has no Conditional Access.)
• Is MFA turned on for every account, not just administrators?
• Do you have Conditional Access policies configured to respond to medium and high sign-in risk?
• Are third-party apps connected via SSO rather than separate credentials?
• Does someone actually review security alerts in the Microsoft Defender portal, or do they sit unseen?

If the answer to any of these is “I’m not sure”, that is worth following up. The Microsoft Security tooling is genuinely good when it is set up correctly. The gap is almost always in configuration, not the product itself.

Common questions about impossible travel in Microsoft 365

Does impossible travel protection work automatically, or does someone need to set it up?

Impossible travel detection is enabled by default in Microsoft Defender for Cloud Apps once you have the right licences and sign-in logs flowing into the platform. However, the automated response, such as blocking access or requiring MFA on a risky sign-in, requires Conditional Access policies to be configured. Detection without a policy means you get the alert but no automatic block. Both pieces need to be in place.

Can impossible travel alerts produce false positives?

Yes, and it is worth knowing the common causes. VPNs that route traffic through overseas servers, certain iPhone carrier IP routing, and staff who travel legitimately can all trigger alerts. The system learns normal behaviour over 14 days, which reduces false positives over time. Named locations and trusted IP ranges can also be configured in the portal to suppress alerts from known safe addresses.

What is the difference between Entra ID Protection and Defender for Cloud Apps for this?

Entra ID Protection (requires Entra ID P2) scores every sign-in for risk in real time and can feed those risk signals into Conditional Access policies. Microsoft Defender for Cloud Apps provides the named impossible travel anomaly alert with richer context, including timestamps, IP addresses, and activity metadata. In a fully configured Microsoft 365 E5 environment, both work together. In Business Premium, you have Conditional Access via Entra ID P1 but not the full anomaly detection layer.

What should we do if an impossible travel alert fires?

First, check whether the user was actually travelling. If they confirm the sign-in is theirs, mark it as safe and add the location or IP to named locations. If the sign-in is not recognised, treat the account as compromised: reset the password immediately, revoke all active sessions, and check the mailbox for forwarding rules or suspicious sent emails. Then investigate how the credentials were taken, usually a phishing email.

Is Microsoft 365 Business Premium enough to protect a small business?

Business Premium is a solid baseline. It includes Entra ID P1 for Conditional Access, Defender for Business for endpoint protection, and built-in email security. Full impossible travel anomaly detection through Defender for Cloud Apps requires Entra ID P2, which is not included in Business Premium. For most SMEs, Business Premium configured correctly provides strong protection. Businesses handling sensitive data may want to assess whether the E5 or add-on Defender suite is justified.

Where do we get started if we want to check our current setup?

The best starting point is an IT security assessment. This looks at which Microsoft 365 licences you hold, how your Conditional Access policies are configured, whether MFA is enforced across all users, and whether your administrator is actually reviewing security alerts. Think Technology Australia carries out these assessments for Brisbane businesses regularly. It takes a few hours and gives you a clear picture of what is and is not protecting your team.

How do we get started?

If you want to confirm that impossible travel protection is active in your environment, or you are not sure which Microsoft 365 plan covers your team, we are happy to take a look. Get in touch with the team at Think Technology Australia and we can walk you through what you have and what gaps, if any, need addressing.