high KQL Entra ID

Cloud Sign-In From a First-Seen Country After Failures

A success is only interesting in context. This pairs it with recent failures for the same account and a country that account has never signed in from in 30 days.

Rule source

entra-signin-new-country-after-failure.kql

// Successful Cloud Sign-In From a First-Seen Country After Failures
// T1078.004 - Valid Accounts: Cloud Accounts
// A success is only interesting in context. This pairs it with recent failures
// for the same account and a country that account has never signed in from.

let lookback  = 30d;
let window    = 1h;
let seen_countries =
    SigninLogs
    | where TimeGenerated between (ago(lookback) .. ago(window))
    | where ResultType == 0
    | summarize by UserPrincipalName,
        Country = tostring(LocationDetails.countryOrRegion);
SigninLogs
| where TimeGenerated > ago(window)
| where ResultType == 0
| extend Country = tostring(LocationDetails.countryOrRegion)
| join kind=leftanti seen_countries on UserPrincipalName, Country
| join kind=inner (
    SigninLogs
    | where TimeGenerated > ago(window)
    | where ResultType in ("50126", "50053")
    | summarize Failures = count() by UserPrincipalName
    | where Failures >= 3
  ) on UserPrincipalName
| project
    TimeGenerated, UserPrincipalName, Country, IPAddress,
    AppDisplayName, Failures,
    MfaDetail = tostring(parse_json(AuthenticationDetails)[0].authenticationMethod)
| order by TimeGenerated desc

Required telemetry

Entra ID SigninLogs

Confirm this source is arriving before you judge the rule. A detection built on telemetry you do not collect looks identical to one that simply never fires.

Known false positives

Genuine travel - pair with a travel calendar feed rather than muting the rule
VPN and corporate egress changes that move a user to a new country overnight

Validation

Replayed a lab tenant sign-in through a foreign egress after seeded failures

Re-run quarterly. Rules decay because the environment moves underneath them - agent upgrades, schema changes and config edits all break detections silently.