Irregular sign in activity should display what's normal before the triggered event
The report "Irregular sign in activity" should show what's normal, and detailed why this was triggered.
If it's a atypical location: What is the typical?
Signed in from a location distant from the previous location: What was the previous?
If you have hundreds of users, sending just this list to an administrator is not sufficient.
Nima Hashemi commented
Thank you Anders and Mohammad for your feedback.
This is definitely something the team is looking to incorporate in a future release. Stay tuned :)
Adam Steenwyk [asteen@MSFT] commented
Same question this morning was asked by our manager. is it because users may activate VPN on their devices?