User Accounts - Unusual authentications occurring when countries do not conduct normal business operations.

Identifies users whose single Factor Auth Events in scenarios where it has not been seen before, or where only multi factor auth has been observed.

Detection logic

Platform: Containers ESXi IaaS Identity Provider Linux macOS Network Devices Office Suite SaaS Windows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
Log source product: azureactivedirectory behavioranalytics
Log source service: identityinfo signinlogs