See sign-in attempts from abroad in Microsoft 365
AlertControl shows for every sign-in to your Microsoft 365 which country it came from, whether it succeeded and what Conditional Access did. Sign-ins outside your home country are highlighted, and a successful sign-in from abroad gets high severity. So you quickly see whether someone other than your staff is signing in.
Updated 30 October 2026
What do you see for each sign-in?
For each sign-in you see the time, the user, the app, the IP address, the country, the error code with Microsoft's reason, the Conditional Access result (success, not applied or failure) and the risk level.
With the filters you show only sign-ins from abroad, or only sign-ins that succeeded, were interrupted or failed. Click a row for all details.
How does AlertControl decide the severity?
• Successful in your home country: informational.
• Interrupted for an extra step, such as "Stay signed in?" or an MFA prompt: informational.
• Failed: medium.
• Ten or more failed attempts for the same user within 4 hours: high.
• Successful from abroad: high.
You choose your home country yourself at the top right of the dashboard: the Netherlands, Belgium, the United Kingdom, Germany, France or Spain.
What do you need?
Microsoft only releases sign-ins if at least one user in your tenant has Microsoft Entra ID P1, for example through Microsoft 365 Business Premium. Microsoft keeps sign-ins for 30 days. On the dashboard you use the slider to choose 4 hours, 24 hours, 2 days, 7 days or everything Microsoft keeps.
Frequently asked questions
Yes. Every sign-in shows whether it succeeded, was interrupted or failed, with the error code and Microsoft's reason. With the Abroad only filter and the Success, Interrupted and Failed buttons you immediately see the sign-ins that matter.
Then you see a successful sign-in from that country with high severity. Check with the employee that it is correct. AlertControl only has read access and blocks nothing itself; you stop sign-ins from certain countries with Conditional Access in Microsoft Entra ID.
Microsoft keeps sign-ins for 30 days. On the dashboard you choose 4 hours, 24 hours, 2 days, 7 days or everything; AlertControl fetches up to 1,000 sign-ins at a time.
Your tenant probably has no Microsoft Entra ID P1. Without that licence Microsoft does not release the sign-ins, and the dashboard tells you so.
See for yourself what is happening in your Microsoft 365?
Try AlertControl free for 30 days. You sign in with your Microsoft account and grant read-only consent once.