Impossible travel alerts on failed logins

Correct. 

Ultimately I am trying to find a way to automate some of the user alerts to email them suspicious activity and give them the option to go change their password. The alerts need to be digestible and understood by them though. If they are traveling and access email on their phone and then get into RDS or VPN.. boom! impossible travel. The Impossible Travel alerts description also includes all those failed login locations.

For accounts that we know have been compromised based on some criteria, I see an automated flow that logs them out of all apps, resets their password and then text them that password to their MFA phone number. I know I'm dreaming but one day we will get there.

Thanks for taking the time to get back to me!