Impossible travel

Concept

Impossible travel is a risk detection that flags sign-ins by the same user from locations too far apart to be reached in the time between them, a common signal of compromised credentials or replayed tokens.

Title graphic: Impossible travel (Concept)

Type	Concept

Key points about Impossible travel

The stolen identity reappears from impossible locations, which is the signal behind impossible travel detection in Microsoft Entra ID. · Detect Impossible Travel and Token Replay in…

Episodes about Impossible travel

Detect Impossible Travel and Token Replay in Microsoft…

2025-12-19 · Video on YouTube

This episode plays out like a cybercrime thriller, exposing how today’s most dangerous breaches don’t smash doors—they’re invited inside. The investigation opens with a single click on January 12th. A polished phishing email doesn’t steal a password; it…

Articles about Impossible travel (4)

Sign-In Risk vs. User Risk in Microsoft Entra ID: What is the Difference?
2026-10-26 · Mirko Peters
Learn the critical differences between sign-in risk and user risk in Microsoft Entra ID Protection and how to configure conditional access properly.
Mastering Impossible Travel Detection in Microsoft Entra ID
2026-08-28 · Mirko Peters
Welcome back to the companion blog for our ongoing podcast series. As cloud environments expand and remote work becomes the undisputed baseline for organizations wo…
Mastering Zero Trust: How Conditional Access Drives Modern Security
2026-08-27 · Mirko Peters
Welcome to our deep dive into the architecture of modern digital protection. As organizations transition away from traditional perimeter-based network security, the…
Identity Protection vs Conditional Access: Getting Microsoft Entra ID Security Right
2026-04-26 · Mirko Peters
Identity is the new security battleground, and with Microsoft Entra ID at the center of most organizations' IT, making sense of your options is absolutely essential…

Frequently asked questions

What is impossible travel and why does it matter?

Impossible travel is when one identity appears from locations too far apart to be reached in the time available. In the episode it is the clue that a stolen token is being used from elsewhere. · From the episode: Detect Impossible Travel and Token Replay in…

Glossary

Community wiki

Short info above, community knowledge below: add practical tips, examples or corrections. New contributions are reviewed first; trusted members publish directly.

Experts and companies for this topic

Nobody has listed this topic yet. Add it to your profile.

Sources

Feed for this topic (RSS): entity/impossible-travel/feed.xml
M365.FM episodes on this topic: 1
Articles on this topic: 4

Maintained by Mirko Peters (Microsoft MVP) · Last updated: 2026-11-03