Oslo, then Lagos, 26 minutes later
Read an Entra ID sign-in export with jq. Find the sign-in from a country the user could not have reached, the app it opened, and why MFA did not stop it.
Briefing
Identity Protection flagged jonas.lie for impossible travel. He says he has been at his desk in Oslo all morning.
Sign-in logs record IP, location, app, client type, the error code (0 is success), and whether MFA was satisfied. A successful MFA from somewhere new often means the session was relayed through a phishing proxy, which passes the real MFA prompt to the user.
cloud-shell · Cloud logs
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.