Free tools Windows power users keep installed
One-click scans. No signup required.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
A successful password check does not prove that the account’s owner signed in. Companies detect possible unauthorized logins by combining authentication records with information about the network, device, location, and account’s normal behavior. They then use risk rules or analytics to decide whether to allow access, ask for stronger authentication, block the attempt, or investigate it. Monitoring what happens after sign-in matters too: an attacker using a stolen session token may not generate a new password-login event at all.
What counts as an unauthorized login?
The phrase can describe several different events, and they do not all establish that an account was compromised:
- An unsuccessful unauthorized attempt: Someone tried to authenticate but did not get in.
- A successful unauthorized login: Someone other than the account owner gained access using a stolen password, session, token, recovery method, or other accepted authentication flow.
- A compromised account: An attacker has control of an otherwise legitimate account, potentially including its active sessions or connected applications.
- A policy violation: The actual employee signs in from a device, location, or application the organization does not permit.
- A false positive: A legitimate sign-in looks unusual because of travel, VPN use, a mobile network, a cloud security gateway, or inaccurate IP geolocation.
Security systems usually identify suspicious activity, not the attacker’s identity or intent. An alert is a reason to assess the evidence; it is not, by itself, proof of a breach.
What companies examine during sign-in
An identity system can record more than whether a password was accepted. Useful sign-in telemetry typically includes:
#1 Best Overall
- Used Book in Good Condition
- Account context: User and tenant identifiers, account type, role, and whether the account is privileged or dormant.
- Time and result: Timestamp, authentication duration, and whether the attempt succeeded, failed, was interrupted, or was blocked.
- Connection: Source IP address, network or autonomous system, approximate country or region, and known proxy, VPN, or hosting-provider indicators.
- Device and client: Device identifier where available, operating system, browser, client application, and whether the device is managed or compliant with policy.
- Authentication evidence: Authentication method, MFA outcome, Conditional Access or equivalent policy decision, and relevant session or token context.
- Resource requested: The application or cloud service the account attempted to access.
Companies may correlate those records with later actions: files opened or downloaded, mailbox rules added, OAuth applications approved, permissions changed, or access keys created. A login event without this surrounding context can be difficult to interpret.
Log interpretation also takes care. In Microsoft Entra, for example, investigators should inspect the authentication details and method rather than relying on one field that summarizes the authentication requirement. Previously satisfied MFA claims can affect how a sign-in appears in the logs. See Microsoft’s MFA reporting guidance.
Signals that can make a login look risky
Companies combine signals rather than treating any one of them as a verdict. A new country may be harmless; a new country combined with an unfamiliar device, a high-risk IP, and an unusual download is more concerning.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repeated failures and password attacks
Repeated failed sign-ins can indicate that someone is guessing credentials or testing stolen passwords. Detection looks for patterns such as many failures against one account, one source trying many accounts, or multiple sources targeting the same account. A successful sign-in after a burst of failures deserves particular attention, especially for an administrator or other high-impact account.
- Brute force: Repeatedly trying passwords against one account.
- Password spraying: Trying a small number of common passwords across many accounts, often to avoid account lockouts.
- Credential stuffing: Testing username-and-password pairs exposed in other breaches.
Attempts can be distributed across IP addresses or spread over time, so a single simple threshold will not catch every campaign. Microsoft’s security operations guidance for user accounts recommends monitoring high volumes of failed sign-ins as well as unusual successful sign-ins, with extra scrutiny for privileged accounts and unapproved locations, IPs, browsers, or operating systems.
Unfamiliar location or network
A login can be flagged when the user appears in a country, region, city, network, or hosting environment not previously associated with the account. Systems may also consider whether the connection comes through an anonymous proxy, Tor exit node, or other infrastructure associated with suspicious activity.
Location is a clue, not proof. IP geolocation can be approximate or wrong. A corporate VPN or cloud security gateway can make employees appear to connect from the same distant location; mobile carriers and remote desktops can also distort the apparent source. Microsoft Entra’s risk-detection documentation describes unfamiliar sign-in properties that can consider IP, network, location, device, browser, and tenant subnet. For new users, Microsoft says the minimum learning period for this detection is five days, while the actual period is dynamic. That is a product-specific behavior, not an industry-wide rule.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsImpossible or atypical travel
“Impossible travel” means the same account appears to have signed in from places so far apart, so close together in time, that ordinary travel between them is implausible. For example, sign-ins attributed to New York at 10:00 and Singapore at 10:20 would merit review.
That pattern could reflect stolen credentials, a stolen session, or concurrent account use—but it can also result from VPN routing, cloud egress points, shared networks, or inaccurate geolocation. Microsoft Defender for Cloud Apps says its impossible-travel detection uses suppression logic for some common VPN and organizational-location cases and has an initial seven-day learning period. Those are specific product details, not universal settings; see its anomaly detection policy documentation. CISA also recommends considering geolocation and impossible-travel patterns while warning that such detections can produce false positives (CISA guidance).
New device, browser, or network characteristics
An unfamiliar device, operating system, browser, ISP, or tenant network can add risk—particularly if the account is accessing a sensitive application from an unmanaged device. But these properties change during normal use: an employee may replace a phone, update a browser, clear cookies, roam between mobile networks, or connect through a new company gateway. “New” means the system has limited history for comparison, not that the device is malicious.
IP reputation and threat intelligence
Identity systems can compare source addresses and other indicators with information about known malicious infrastructure, password-spray activity, malware-linked networks, or suspicious proxies. Microsoft Entra risk categories include detections such as malicious IP activity, password spraying, malware-linked IPs, and anonymous IP use (risk detection details).
Reputation data is noisy. Addresses may be shared, recycled, or used by both legitimate and malicious customers of a service. A reputation match should change an event’s risk assessment, not decide the case alone.
MFA failures, denials, and changes
Multi-factor authentication (MFA) gives companies another source of evidence as well as another barrier to entry. Relevant events include repeated MFA failures, a user denying a prompt, a password accepted but MFA not completed, repeated prompts in a short period, and enrollment of a new authenticator or change to recovery methods. A denial or unexpected prompt report may indicate that someone has the password and is attempting to persuade the user to approve access.
MFA reduces risk but is not a guarantee. Attackers can phish users through adversary-in-the-middle pages, steal active session cookies or tokens, compromise an endpoint, exploit weak recovery procedures, or pressure a user into approving prompts. Organizations increasingly prefer phishing-resistant methods such as passkeys or hardware security keys, particularly for administrators. CISA describes MFA as a way to make unauthorized access more difficult, not an absolute defense (CISA MFA guidance). Microsoft also documents how suspicious MFA reports can appear in sign-in, audit, and risk-detection records (MFA settings guidance).
How systems combine signals
Rules and behavioral analytics help turn raw events into decisions. A simple rule might flag one source address failing against many accounts. A more contextual system might raise risk when an unfamiliar device and network coincide with a request for sensitive data, or when a successful sign-in is followed by a new mailbox-forwarding rule.
User and Entity Behavior Analytics (UEBA) can compare activity with a user’s own history and, where appropriate, a peer group. That history may include normal login hours and networks, devices, applications, data accessed, download volume, and administrative actions. A system might therefore distinguish an unusual login on its own from an unusual login followed by bulk downloads or privilege changes. The quality of the result depends on the available history, coverage, and tuning; a new account or a shared account offers a weak baseline. Microsoft describes investigations combining anomalous sign-ins with later activity in its suspicious-activity tutorial.
Useful systems make the reason for an alert visible: for example, a new device, risky network, unusual MFA result, or sensitive action after sign-in. A bare “high risk” label is less useful to an investigator than the evidence behind it.
Why companies monitor after sign-in
Some account takeovers become apparent only after access is granted. An attacker may behave quietly at first, or may use a stolen token rather than submit a password again. Companies therefore look for activity such as:
Rank #4
- Large or unusual downloads, bulk exports, or access to data outside the account’s normal role.
- Mailbox forwarding rules, unusual email sending, or mass sharing with external parties.
- Unexpected OAuth application consent or permissions that allow an application to read email or other data.
- New API keys, access keys, personal tokens, devices, or authentication methods.
- Privilege or group-membership changes, password resets, and recovery-method changes.
- Suspicious API use, administrative commands, or access from multiple distant environments.
OAuth grants and tokens matter because they can provide continued access without repeated password logins. Microsoft advises auditing consented applications and permissions as part of identity security (identity security guidance). Its token protection guidance discusses token-related risks including stolen session cookies and adversary-in-the-middle activity. A lack of a fresh password event therefore does not rule out misuse of an account or session.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →From alert to access decision
Most organizations use a response ladder rather than blocking every unfamiliar login:
- Allow and monitor when context appears ordinary or the risk is low.
- Challenge the user to complete MFA or reauthenticate when more confidence is needed.
- Require stronger authentication or restrict access for elevated risk, sensitive applications, or privileged roles.
- Block access when policy or the available evidence indicates an unacceptable risk.
- Contain and investigate when compromise is plausible: revoke sessions, review account changes, and examine subsequent activity.
Risk-based access policies can make these decisions automatically. Microsoft Entra documentation describes Conditional Access policies that target elevated sign-in risk and require stronger authentication or deny access. Microsoft recommends testing policies in report-only mode and planning exclusions for emergency or break-glass accounts before enforcement (risk-based sign-in policy guidance). A policy that blocks access without a tested recovery route can lock out legitimate users—or the administrators needed to restore access.
How an organization investigates a flagged sign-in
A practical investigation connects the authentication event to the person, device, and activity around it:
- Review the full event: Confirm the account, timestamp and time zone, source network, device, application, authentication method, MFA result, policy outcome, and risk reasons.
- Compare nearby events: Look for failures before the success, other accounts targeted from the same source, other locations used by the account, and noninteractive sign-ins or token activity.
- Check what followed: Review data access, downloads, mailbox changes, OAuth grants, new authentication methods, and privilege changes.
- Verify with the user through a trusted channel: Do not rely on a reply to a potentially suspicious email or an unverified phone number in the alert.
- Contain when warranted: Revoke active sessions or tokens, reset credentials, remove unauthorized authentication methods or grants, and disable the account if necessary.
- Assess connected systems: If endpoint compromise is suspected, investigate or isolate the device and check related accounts and services.
- Preserve and improve: Retain relevant logs, document the decision, and tune the detection if it was a false positive or missed important context.
For Microsoft Entra administrators, the starting points include Entra ID → Monitoring & health → Sign-in logs, the Authentication details for an individual sign-in, Protection → Risk detections, Protection → Risky users, and audit logs for account, authentication-method, and application-consent changes. Labels can change as the service evolves, so consult current Microsoft documentation if a portal path differs.
Central logs make correlation possible
Identity logs are more useful when investigators can compare them with VPN, endpoint, firewall, cloud-service, and application records. A central security information and event management (SIEM) platform or equivalent log repository can connect events that separate systems would show in isolation—for example, a VPN login in one country, a SaaS sign-in elsewhere, and an endpoint malware alert soon after.
Best Value
Central retention also helps preserve evidence if an attacker can alter or delete logs on an individual device or service. CISA recommends storing logs in usable formats and forwarding them to a centralized repository (CISA guidance on weak security controls). A SIEM is not automatically useful just because it collects data: the organization still needs appropriate sources, retention, alert triage, and a response process.
What a small company can put in place
A small organization does not need to reproduce a large security operations center to improve account-takeover detection. Start with the controls that give the most visibility and make response possible:
- Use a central identity provider for business accounts where practical, and avoid shared user accounts so activity can be attributed to a person.
- Require MFA, prioritizing administrators, email, and access to sensitive data. Prefer phishing-resistant options for high-impact accounts where available.
- Enable sign-in and audit logging; confirm that records include successful as well as failed events and are retained long enough to investigate.
- Set alerts for suspicious successful sign-ins, repeated failures across accounts, unusual administrator access, unexpected MFA activity, and sensitive account changes.
- Review new authentication methods, OAuth grants, mailbox forwarding, and privilege changes—not just password events.
- Export important logs to a central, access-controlled location if the organization’s tools support it.
- Write a short account-compromise procedure covering trusted user verification, session revocation, credential reset, evidence preservation, and escalation.
- Test alerts with a designated test account and tune for legitimate VPNs, travel, contractors, remote desktops, and shared network egress.
Capabilities vary by identity provider, edition, and license. For example, some Microsoft Entra risk detections and risk-based policies require particular Entra or Microsoft security licenses; do not assume a feature is included simply because its documentation is public. The practical result also depends on logging coverage and someone being able to respond to alerts.
Common limitations and mistakes
| Signal or situation | Why it helps | Why it can mislead |
|---|---|---|
| Failed-login volume | Can expose guessing, spraying, and credential stuffing. | Attempts may be slow or distributed to evade simple thresholds. |
| Foreign location or impossible travel | Can reveal unexpected concurrent use or geographic policy violations. | VPNs, cloud gateways, mobile networks, shared egress, and geolocation errors create false positives. |
| IP reputation | Can add context about known malicious infrastructure. | IP addresses are shared or recycled; reputation is not proof about the user. |
| New device or browser | Can surface an unfamiliar access environment. | Device replacement, updates, private browsing, or cleared cookies may look new. |
| MFA denial or repeated prompt | May indicate password compromise or an attempt to pressure the user. | Legitimate users can deny or fail prompts; follow up with the user. |
| Bulk download or new OAuth grant | Can reveal harmful activity after access is granted. | Some jobs and approved applications legitimately create similar activity. |
Other cases need special treatment. Remote desktops and virtual desktop infrastructure (VDI) can make many users look alike. Contractors may have different normal devices and locations. Service accounts often use noninteractive credentials or API access, so ordinary employee login rules may not apply; monitor keys, tokens, and service activity. New users have little history to establish a baseline. Legacy authentication may expose fewer device and client signals; Microsoft notes that unfamiliar-property detection has limited data for legacy protocols and recommends moving to modern authentication where possible (Microsoft risk-detection details).
Common mistakes include treating a foreign IP as proof of hacking, alerting on every new address without accounting for company VPNs, monitoring failures but not unusual successes, ignoring noninteractive sign-ins, collecting logs without central retention, and enforcing automatic blocks without a recovery path. Fixed thresholds can be useful starting points, but they need tuning for the organization’s size, roles, networks, and normal work patterns.
Quick Recap
Quick readiness checklist
- Can you see who signed in, when, from what device and network, and to which application?
- Can you tell whether MFA was completed, denied, or bypassed through an existing session?
- Do you alert on suspicious successful logins as well as repeated failures?
- Can you review activity after sign-in, including downloads, mailbox rules, OAuth grants, and privilege changes?
- Are important logs centralized and retained for investigation?
- Can you revoke sessions and credentials quickly, and do you have a tested way to restore legitimate access?
- Have you accounted for VPNs, travel, mobile networks, contractors, VDI, service accounts, and privileged users?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
