Impossible Travel

Impossible travel is a Microsoft Entra ID Identity Protection risk signal triggered when sign-ins for a single user occur from geographically distant locations within a physically impossible timeframe — e.g., London at 09:00 and Tokyo at 09:15. The pattern is impossible for a real human; it's almost always indicative of credential theft (the legitimate user signing in from one location while an attacker uses the stolen credentials from another). Risky sign-in policies can automatically block, require MFA, or force password reset on impossible-travel detections. One of the highest-fidelity Identity Protection signals — false positives are rare and the true positives are usually critical.