CAS Impossible Travel Alerts

AleA79 While analyzing the impossible travel alert, its always advised to check the reputation of the two IPs. For True positive cases, you will generally see the other IP to be blacklisted. In such cases, you should go ahead with resetting of user's password and terminating any active O365 sessions.

You may see False Positives sometimes in case the user is actually travelling and signing from an unsecure network or may be when he uses VPN.

However as per Microsoft documentation, it says that this detection uses a machine learning algorithm that ignores obvious "false positives" contributing to the impossible travel condition, such as VPNs and locations regularly used by other users in the organization. The detection has an initial learning period of seven days during which it learns a new user's activity pattern.