A suspicious sign-in: what should your team check?

Start with the actual event

An authorised administrator should open the relevant service directly and review its sign-in records. Avoid using a link in an unexpected email as the route into an administration account.

Record the affected account, event time and time zone, sign-in result, application, IP address and device information. Note the authentication methods and results shown in the logs. Keep the original alert reference so the investigation can be followed later.

Check the location and device in context

Microsoft notes that location derived from an IP address is an estimate. A VPN or network provider can make an expected sign-in appear in an unfamiliar place. That is a reason to check the context, rather than treat the location label as a final verdict.

Ask whether the device and application are expected, whether the sign-in succeeded and whether the authentication activity matches what the employee was doing.

• Check the event time against the employee’s activity.
• Review the sign-in result and available authentication evidence.
• Look for related sign-ins and security-setting changes.

Contact the user through a known channel

Use an established phone number or another trusted contact method. Ask what the employee was doing at the recorded time and whether they recognise the device or any authentication prompt.

Keep the questions factual. An employee’s answer is part of the assessment, alongside the service records. Do not ask them to share a password, access token or authentication code.

Look beyond the sign-in

If the activity remains suspicious, the authorised administrator should review related account changes and resource access. The available records and checks depend on the service and the permissions in place.

For example, an unfamiliar sign-in followed by a new authentication method or an unexpected access change deserves closer investigation. Record which observations are confirmed and which questions remain open.

Agree and record the response

When the evidence points to unauthorised access, follow the approved incident process. Microsoft’s identity guidance describes actions such as blocking access, resetting credentials and revoking sessions or tokens. The appropriate sequence and effect depend on the environment.

Do not assume that a password change ends every active session. The administrator should follow the provider’s current guidance, confirm which access the action revokes and coordinate any effect on business operations.

Close the loop

Record the evidence considered, the decision, the actions taken and who authorised them. If the sign-in was expected, document why. If it was a compromise, keep tracking the incident until the agreed follow-up work is complete.

Use the finding to improve the process: were the records available, did the right contact respond and was the team clear about who could act? Those answers are useful even when the alert turns out to be benign.