Created by Claude - please verify

Unusual sign-ins - 'usual' countries are derived from this tenant's own last 7 days; VPNs and roaming users produce false positives.

Required Microsoft Graph permissions

AuditLog.Read.All — application permission, granted to the app registration with admin consent.

Licence: Microsoft Entra ID P1.

Endpoint: GET /beta/auditLogs/signIns?$filter=createdDateTime ge (7 days)

Interactive sign-ins of the last 7 days, capped at 50,000 rows. 'Usual' = a country with at least 2% of successful sign-ins. Consider blocking the device-code flow with Conditional Access (Authentication flows condition).

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Sign-ins from Unusual Countries & Device-code Flow

Two things Conditional Access often lets through: successful sign-ins from countries your organisation rarely signs in from, and the device-code flow - where a user types a code on microsoft.com/devicelogin, the technique behind a wave of token-phishing campaigns. Device-code sign-ins are listed first.

No device-code sign-ins and no successful sign-ins from unusual countries in the last 7 days.