# Respect the country boundary when testing Cloud Apps impossible-travel detection

> Why might geographically distant activity produce no Defender for Cloud Apps impossible-travel alert?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-039-respect-the-country-boundary-when-testing-cloud-apps-impossible-travel-detection/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:34:21+00:00
- Modified: 2026-09-17T16:35:04+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Why might geographically distant activity produce no Defender for Cloud Apps impossible-travel alert?

## Potentially affected

Apply this interpretation to the Defender for Cloud Apps Impossible travel anomaly detection. Record the policy scope, sensitivity and activity types before using a test to assess coverage.

## DSE recommendation

DSE recommends checking these documented exclusions before interpreting an alert-free test.

## Article

## Source facts

Microsoft calculates locations at country or region level and states that two actions within the same or bordering countries or regions do not trigger this detection. If both travel endpoints have safe IP addresses and sensitivity is below High, the activity is trusted and excluded. The documented anomaly alerts, including impossible travel, do not apply to failed or non-interactive logins. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy).

## Applicability

Apply this interpretation to the Defender for Cloud Apps Impossible travel anomaly detection. Record the policy scope, sensitivity and activity types before using a test to assess coverage.

## DSE recommendation

DSE recommends checking these documented exclusions before interpreting an alert-free test. Describe the actual detection question in the test plan and identify other telemetry needed to investigate activity outside this detector’s scope. Review any proposed sensitivity change against the organization’s investigation capacity and false-positive expectations.

## Verification

For an approved detection exercise, retain the relevant activity records and compare their country classification, IP categorization and login type with the documented conditions. Record whether the exercise was eligible for this detector before evaluating the alert outcome. Continue investigating suspicious activity using available evidence even when this particular alert is absent.

## Official references

[Microsoft Learn: Create Defender for Cloud Apps anomaly detection policies](https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy). Source reviewed September 17, 2026.

## Primary reference

- Name: Anomaly detection policies in Microsoft Defender for Cloud Apps - Microsoft Defender for Cloud Apps | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Respect the country boundary when testing Cloud Apps impossible-travel detection,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-039-respect-the-country-boundary-when-testing-cloud-apps-impossible-travel-detection/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.