Sign-ins from Unusual Countries & Device-code Flow

The question it answers: Who used the device-code flow, and who signed in successfully from a country the tenant rarely signs in from, in the last 7 days?

Two things Conditional Access often lets through: successful sign-ins from countries your organisation rarely signs in from, and the device-code flow - where a user types a code on microsoft.com/devicelogin, the technique behind a wave of token-phishing campaigns. Device-code sign-ins are listed first.

Note

Interactive sign-ins of the last 7 days, capped at 50,000 rows. ‘Usual’ = a country with at least 2% of successful sign-ins. Consider blocking the device-code flow with Conditional Access (Authentication flows condition).

At a glance

Where in the app	Entra ID › Sign-in Analytics › Unusual Countries & Device Code
Workload	Entra ID
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Entra ID P1.
Report id (API and MCP)	entra.sign-ins.unusual-sign-ins

Columns

Column	Key	Type
User	Name	Link
UPN	Secondary	Text
Type	Category	Status
Finding	Finding	Text
Sign-ins	Count	Text
Where / app	Detail	Text
Last seen	LastSeen	DateTime

What it needs

Licence: Microsoft Entra ID P1.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
AuditLog.Read.All	Microsoft Graph	Read all audit log data

Data sources it reads

• GET /beta/auditLogs/signIns?$filter=createdDateTime ge (7 days)

Through the API and MCP

GET /ir-api/v1/reports/entra.sign-ins.unusual-sign-ins?size=100

An AI assistant reads it with the MCP tool get_report and the id entra.sign-ins.unusual-sign-ins. The client needs the Read grant for Entra ID. See Using the API.