{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-039-respect-the-country-boundary-when-testing-cloud-apps-impossible-travel-detection/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-039-respect-the-country-boundary-when-testing-cloud-apps-impossible-travel-detection/", "slug": "dse-20260917-039-respect-the-country-boundary-when-testing-cloud-apps-impossible-travel-detection", "url": "https://update.dsesecurity.com/updates/dse-20260917-039-respect-the-country-boundary-when-testing-cloud-apps-impossible-travel-detection/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-039-respect-the-country-boundary-when-testing-cloud-apps-impossible-travel-detection.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-039-respect-the-country-boundary-when-testing-cloud-apps-impossible-travel-detection/" }, "title": "Respect the country boundary when testing Cloud Apps impossible-travel detection", "summary": "Why might geographically distant activity produce no Defender for Cloud Apps impossible-travel alert?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:34:21+00:00", "modified_at": "2026-09-17T16:35:04+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 208, "potentially_affected": "Apply this interpretation to the Defender for Cloud Apps Impossible travel anomaly detection. Record the policy scope, sensitivity and activity types before using a test to assess coverage.", "dse_recommendation": "DSE recommends checking these documented exclusions before interpreting an alert-free test.", "primary_source": { "name": "Anomaly detection policies in Microsoft Defender for Cloud Apps - Microsoft Defender for Cloud Apps | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft calculates locations at country or region level and states that two actions within the same or bordering countries or regions do not trigger this detection. If both travel endpoints have safe IP addresses and sensitivity is below High, the activity is trusted and excluded. The documented anomaly alerts, including impossible travel, do not apply to failed or non-interactive logins. Microsoft Learn.

\n

Applicability

\n

Apply this interpretation to the Defender for Cloud Apps Impossible travel anomaly detection. Record the policy scope, sensitivity and activity types before using a test to assess coverage.

\n

DSE recommendation

\n

DSE recommends checking these documented exclusions before interpreting an alert-free test. Describe the actual detection question in the test plan and identify other telemetry needed to investigate activity outside this detector’s scope. Review any proposed sensitivity change against the organization’s investigation capacity and false-positive expectations.

\n

Verification

\n

For an approved detection exercise, retain the relevant activity records and compare their country classification, IP categorization and login type with the documented conditions. Record whether the exercise was eligible for this detector before evaluating the alert outcome. Continue investigating suspicious activity using available evidence even when this particular alert is absent.

\n

Official references

\n

Microsoft Learn: Create Defender for Cloud Apps anomaly detection policies. Source reviewed September 17, 2026.

", "content_text": "Source facts\nMicrosoft calculates locations at country or region level and states that two actions within the same or bordering countries or regions do not trigger this detection. If both travel endpoints have safe IP addresses and sensitivity is below High, the activity is trusted and excluded. The documented anomaly alerts, including impossible travel, do not apply to failed or non-interactive logins. Microsoft Learn.\nApplicability\nApply this interpretation to the Defender for Cloud Apps Impossible travel anomaly detection. Record the policy scope, sensitivity and activity types before using a test to assess coverage.\nDSE recommendation\nDSE recommends checking these documented exclusions before interpreting an alert-free test. Describe the actual detection question in the test plan and identify other telemetry needed to investigate activity outside this detector’s scope. Review any proposed sensitivity change against the organization’s investigation capacity and false-positive expectations.\nVerification\nFor an approved detection exercise, retain the relevant activity records and compare their country classification, IP categorization and login type with the documented conditions. Record whether the exercise was eligible for this detector before evaluating the alert outcome. Continue investigating suspicious activity using available evidence even when this particular alert is absent.\nOfficial references\nMicrosoft Learn: Create Defender for Cloud Apps anomaly detection policies. Source reviewed September 17, 2026.", "content_markdown": "## Source facts\n\nMicrosoft calculates locations at country or region level and states that two actions within the same or bordering countries or regions do not trigger this detection. If both travel endpoints have safe IP addresses and sensitivity is below High, the activity is trusted and excluded. The documented anomaly alerts, including impossible travel, do not apply to failed or non-interactive logins. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy).\n\n## Applicability\n\nApply this interpretation to the Defender for Cloud Apps Impossible travel anomaly detection. Record the policy scope, sensitivity and activity types before using a test to assess coverage.\n\n## DSE recommendation\n\nDSE recommends checking these documented exclusions before interpreting an alert-free test. Describe the actual detection question in the test plan and identify other telemetry needed to investigate activity outside this detector’s scope. Review any proposed sensitivity change against the organization’s investigation capacity and false-positive expectations.\n\n## Verification\n\nFor an approved detection exercise, retain the relevant activity records and compare their country classification, IP categorization and login type with the documented conditions. Record whether the exercise was eligible for this detector before evaluating the alert outcome. Continue investigating suspicious activity using available evidence even when this particular alert is absent.\n\n## Official references\n\n[Microsoft Learn: Create Defender for Cloud Apps anomaly detection policies](https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy). Source reviewed September 17, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-039-respect-the-country-boundary-when-testing-cloud-apps-impossible-travel-detection/", "url": "https://update.dsesecurity.com/updates/dse-20260917-039-respect-the-country-boundary-when-testing-cloud-apps-impossible-travel-detection/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-039-respect-the-country-boundary-when-testing-cloud-apps-impossible-travel-detection/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Respect the country boundary when testing Cloud Apps impossible-travel detection", "item": "https://update.dsesecurity.com/updates/dse-20260917-039-respect-the-country-boundary-when-testing-cloud-apps-impossible-travel-detection/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-039-respect-the-country-boundary-when-testing-cloud-apps-impossible-travel-detection/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-039-respect-the-country-boundary-when-testing-cloud-apps-impossible-travel-detection/", "url": "https://update.dsesecurity.com/updates/dse-20260917-039-respect-the-country-boundary-when-testing-cloud-apps-impossible-travel-detection/", "headline": "Respect the country boundary when testing Cloud Apps impossible-travel detection", "description": "Why might geographically distant activity produce no Defender for Cloud Apps impossible-travel alert?", "abstract": "Why might geographically distant activity produce no Defender for Cloud Apps impossible-travel alert?", "articleBody": "Source facts\nMicrosoft calculates locations at country or region level and states that two actions within the same or bordering countries or regions do not trigger this detection. If both travel endpoints have safe IP addresses and sensitivity is below High, the activity is trusted and excluded. The documented anomaly alerts, including impossible travel, do not apply to failed or non-interactive logins. Microsoft Learn.\nApplicability\nApply this interpretation to the Defender for Cloud Apps Impossible travel anomaly detection. Record the policy scope, sensitivity and activity types before using a test to assess coverage.\nDSE recommendation\nDSE recommends checking these documented exclusions before interpreting an alert-free test. Describe the actual detection question in the test plan and identify other telemetry needed to investigate activity outside this detector’s scope. Review any proposed sensitivity change against the organization’s investigation capacity and false-positive expectations.\nVerification\nFor an approved detection exercise, retain the relevant activity records and compare their country classification, IP categorization and login type with the documented conditions. Record whether the exercise was eligible for this detector before evaluating the alert outcome. Continue investigating suspicious activity using available evidence even when this particular alert is absent.\nOfficial references\nMicrosoft Learn: Create Defender for Cloud Apps anomaly detection policies. Source reviewed September 17, 2026.", "datePublished": "2026-09-17T16:34:21+00:00", "dateModified": "2026-09-17T16:35:04+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-039-respect-the-country-boundary-when-testing-cloud-apps-impossible-travel-detection/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-039-respect-the-country-boundary-when-testing-cloud-apps-impossible-travel-detection/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Respect the country boundary when testing Cloud Apps impossible-travel detection" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 208, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Anomaly detection policies in Microsoft Defender for Cloud Apps - Microsoft Defender for Cloud Apps | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy" } } ] } }