Respect the country boundary when testing Cloud Apps impossible-travel detection

Source facts

Microsoft calculates locations at country or region level and states that two actions within the same or bordering countries or regions do not trigger this detection. If both travel endpoints have safe IP addresses and sensitivity is below High, the activity is trusted and excluded. The documented anomaly alerts, including impossible travel, do not apply to failed or non-interactive logins. Microsoft Learn.

Applicability

Apply this interpretation to the Defender for Cloud Apps Impossible travel anomaly detection. Record the policy scope, sensitivity and activity types before using a test to assess coverage.

DSE recommendation

DSE recommends checking these documented exclusions before interpreting an alert-free test. Describe the actual detection question in the test plan and identify other telemetry needed to investigate activity outside this detector’s scope. Review any proposed sensitivity change against the organization’s investigation capacity and false-positive expectations.

Verification

For an approved detection exercise, retain the relevant activity records and compare their country classification, IP categorization and login type with the documented conditions. Record whether the exercise was eligible for this detector before evaluating the alert outcome. Continue investigating suspicious activity using available evidence even when this particular alert is absent.

Official references

Microsoft Learn: Create Defender for Cloud Apps anomaly detection policies. Source reviewed September 17, 2026.