What is a suspicious-login alert?¶
A suspicious-login alert is a provider-generated warning that a sign-in or access event matched one or more risk indicators.
Those indicators may include a new device, unfamiliar location, unusual time, known malicious IP address, impossible travel or abnormal behaviour.
What this means in practice¶
The alert can still be valuable. It may preserve a time, account, IP address, device detail, risk score, authentication method and recommended response.
Then look for additional indicators of compromise, such as unfamiliar application consent, changed recovery details, new forwarding rules, unusual downloads, permission changes or new administrators.
A suspicious-login alert may also be generated after the provider later reclassifies an event. The alert time may therefore differ from the actual access time.
Use precise language in reports. State that the provider flagged the event as suspicious and explain the supporting records.
What this does not show on its own¶
The dangerous assumption is that the alert itself proves the login was malicious.
The provider is applying a detection rule or risk model to the underlying event. The rule may produce false positives, and it may not explain exactly why the event was flagged.
What to do next¶
Obtain the underlying sign-in and session records where possible. Ask what event triggered the alert and whether the provider recorded later activity from the same session.
Check whether the user changed device, travelled, used a VPN, connected through a corporate gateway or approved the access.
Do not assume that no alert means no compromise. Detection systems may miss token theft, familiar infrastructure or activity that falls within normal patterns.
Key takeaway
A suspicious-login alert is a provider risk assessment, not proof of malicious access, so examine the event, trigger and subsequent activity before reaching a conclusion.