What is impossible travel detection?

Last reviewed 20 October 2026

Impossible travel detection flags two sign-ins to the same account from places too far apart for one person to have travelled between them in the time available, which usually means someone else has the credentials.

How it works

Each sign-in is placed on a map, usually from its IP address. If the distance between two sign-ins divided by the time between them is faster than any realistic journey, the system raises an alert. Microsoft describes its version as flagging “user activities … originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second” (Microsoft Entra ID Protection).

Why it is noisy

The location behind each sign-in is usually an IP lookup, and IP addresses move for ordinary reasons.

• A VPN or corporate proxy puts the user in another city or country.
• Mobile carriers route traffic through distant gateways.
• Cloud apps sign in from data centres on the user’s behalf.
• IP databases are wrong at city level a large share of the time. See IP vs device geolocation.

So security teams spend time clearing alerts for people who never left their desk, and an attacker on a VPN near the victim’s city does not trigger one at all.

A stronger version

If each sign-in requires a signed statement from the user’s enrolled phone that it is inside the permitted region, there is no distance to infer. The factor passes or fails at sign-in. On its own, that shows where the phone is. Policy can also require a QR scan at each sign-in, so a stolen password used from another computer fails unless the attacker gets the real user to scan the attacker’s screen. See geofactor authentication.