A staff member signs into Microsoft 365 from Washington, D.C.
Ten minutes later, that same account appears to be active from another country thousands of miles away.
Unless your employee has discovered teleportation, you probably have a problem.
There is a cybersecurity concept, and an actual Microsoft security detection, for this scenario: Impossible Travel.
It is a relatively simple idea with an important purpose. Microsoft describes Impossible Travel as a detection that identifies user activity originating from geographically distant locations within a period shorter than it would reasonably take someone to travel between them. In other words, the technology is looking for activity that suggests two different people may be using the same credentials. [1][2]
For associations and nonprofits using Microsoft 365, this is worth understanding because it changes the security conversation from:
“Does everyone have a password?”
to:
“Would we know if someone else started using one of those passwords?”
That is a much better question.
Imagine that your association’s CFO successfully accesses a Microsoft-connected application from Virginia at 9:02 a.m.
At 9:17 a.m., activity associated with that same identity appears to originate from Eastern Europe.
The issue is not simply that someone logged in from another country. People travel. Associations have remote employees. Staff attend conferences. Executives use airport Wi-Fi. Employees work from hotels, homes and mobile devices.
The important part is the combination of geography, timing and normal user behavior.
Microsoft’s Defender for Cloud Apps documentation says its Impossible Travel detection looks for two user activities originating from geographically distant locations within a timeframe shorter than the user could reasonably have traveled between them. Microsoft also says the detection uses machine learning and is designed to disregard certain obvious false positives, including VPN-related activity and locations commonly used by other people in the organization. [2]
It is essentially Microsoft asking:
“Could this reasonably be the same person?”
If the answer appears to be no, that activity deserves attention.
If you are discussing this with your IT provider or MSP, there is an important distinction worth knowing.
Microsoft currently documents both Impossible Travel and Atypical Travel as identity-related risk detections, but they are not exactly the same thing.
Impossible Travel uses information from Microsoft Defender for Cloud Apps and focuses on activity occurring in geographically distant locations within an impossible timeframe.
Atypical Travel is a Microsoft Entra ID Protection risk detection that evaluates sign-ins from geographically distant locations while also considering factors such as a user's previous locations and behavior. Microsoft gives the Atypical Travel model a learning period so it can establish what normal activity looks like for a user. [1]
That distinction may sound technical, but it creates a very practical question for association executives:
“Which Microsoft identity-risk detections are available in our environment, and what happens when one of them fires?”
Your executive director does not need to become a Microsoft security engineer.
But somebody representing the business should know the answer to that question.
A lot of traditional cybersecurity thinking focuses on rejecting an incorrect password.
That is important, but modern account compromise frequently involves criminals obtaining valid credentials.
If an attacker has the correct username and password, the authentication system may initially see what looks like a legitimate user.
That is why identity security increasingly needs to evaluate more than credentials. Systems can consider signals involving location, devices, IP addresses, sign-in history, risk intelligence and behavior.
The broader threat is well established. Verizon's 2026 Data Breach Investigations Report continues to identify stolen credentials among the major methods attackers use to gain access, even as exploitation of software vulnerabilities has now overtaken stolen credentials as the leading initial access path in its dataset. [3]
CISA likewise advises organizations that passwords alone are no longer sufficient protection and recommends multifactor authentication, particularly for email, file storage, remote access, administrative accounts and users handling sensitive information. [4]
Impossible Travel is useful because it is another signal that can help answer a fundamentally different question:
Even if the credentials are valid, does this behavior make sense?
Associations have some characteristics that make identity-based security controls especially valuable.
You may have a relatively small internal staff managing technology that supports thousands, or hundreds of thousands, of members.
Your team may be highly distributed.
Executives travel.
Staff attend conferences and board meetings.
Employees work remotely.
An outside MSP may administer portions of your Microsoft environment.
Employees may have access to membership databases, financial systems, shared files, email, payment information, sponsorship records, event information, board materials and internal documents.
And because associations are highly relationship-driven organizations, a compromised email account can be particularly powerful.
Think about what happens if an attacker gets control of the mailbox belonging to your CEO, CFO, membership director or events team.
The attacker isn't necessarily sending an obviously fake email from a strange domain.
They may be sending an email from the real account.
They can potentially see previous conversations. They may understand vendor relationships. They may learn how invoices are handled. They can imitate the tone of the person whose account they compromised.
That is why detecting compromised identities matters just as much as protecting passwords in the first place.
This distinction is important.
Seeing suspicious activity doesn't automatically mean your organization is protected from it.
Someone still needs to decide what happens when risk is detected.
Microsoft Entra Conditional Access can incorporate sign-in risk into access decisions. For organizations with the appropriate Microsoft Entra ID Protection licensing, policies can be configured to require additional authentication when Microsoft determines that a sign-in presents elevated risk. [5]
Microsoft's current recommendations include requiring multifactor authentication for medium- and high-risk sign-ins. Microsoft also supports risk-remediation workflows and policies that can block access in appropriate situations. [6]
This is where the real value emerges.
You don't simply want a security product generating another email that nobody reads.
You want a process.
Detection → validation → containment → remediation.
That might mean requiring strong authentication, revoking sessions, forcing reauthentication, resetting a compromised password, blocking an account or escalating the incident for investigation depending on the risk and circumstances.
Microsoft specifically advises that when an Atypical Travel event is investigated and administrators confirm the activity was not legitimate, the sign-in should be marked compromised and appropriate remediation actions should be taken. [7]
This is where an association can turn an interesting cybersecurity concept into something useful.
At your next technology or cybersecurity meeting, don't simply ask:
“Do we have Microsoft security?”
That question is far too broad.
Instead, ask your internal IT team or managed service provider:
That conversation is far more valuable than asking whether your organization “has cybersecurity.”
There is another important caveat.
Microsoft 365 is not one universal security configuration.
Features differ by subscription, licensing and configuration.
Microsoft's documentation currently lists specific licensing requirements for full Microsoft Entra ID Protection capabilities, and its Impossible Travel detection incorporates information from Microsoft Defender for Cloud Apps. Organizations therefore should not assume that simply having Microsoft 365 automatically means they have every identity-risk detection described here. [1][6]
That is precisely why associations should ask.
You may discover that you already own capabilities that haven't been fully implemented.
You may discover that you need a different license.
Or you may discover that alerts exist but nobody has clearly defined who is responsible for responding to them.
All three findings are useful.
Impossible Travel is interesting because it demonstrates a broader shift in cybersecurity.
Historically, access decisions were heavily dependent on a username and password.
Today, effective identity security increasingly considers context.
Where is the request coming from?
Is the device familiar?
Is the IP address suspicious?
Does the behavior match the user's normal activity?
Has Microsoft observed other risk signals associated with the account or sign-in?
Does this person normally access this resource?
Should we require stronger authentication before granting access?
This approach aligns closely with the Zero Trust principle of “verify explicitly.” Microsoft describes Conditional Access as a Zero Trust policy engine designed around principles including explicit verification, least-privileged access and assuming breach. [8]
For an association executive, that is the larger lesson.
Cybersecurity shouldn't depend on one gate keeping every attacker out.
It should continuously ask whether what is happening inside your technology environment makes sense.
You don't have to walk into your next board meeting and explain Microsoft's machine-learning models.
Instead, you should be able to say something much more meaningful:
“We are implementing identity-risk controls that can identify suspicious account behavior, including situations where the same identity appears to be operating from geographically impossible locations, and we have defined how those risks are investigated and remediated.”
That communicates something tangible.
It means you are moving beyond passwords.
Beyond simply buying Microsoft 365.
Beyond checking a box that says MFA is enabled.
You are beginning to build an identity security program capable of looking at behavior and risk, not merely credentials.
And that is exactly where modern association cybersecurity needs to go.
[1] Microsoft Learn — What are risk detections? Microsoft Entra ID Protection
https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks
[2] Microsoft Learn — Anomaly detection policies in Microsoft Defender for Cloud Apps
https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
[3] Verizon — 2026 Data Breach Investigations Report
https://www.verizon.com/business/resources/reports/dbir/
[4] Cybersecurity and Infrastructure Security Agency (CISA) — Require Multifactor Authentication
https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/require-multifactor-authentication
[5] Microsoft Learn — Require multifactor authentication for elevated sign-in risk
https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-risk-based-sign-in
[6] Microsoft Learn — Configure and enable risk policies
https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-risk-policies
[7] Microsoft Learn — Investigate risk with Microsoft Entra ID Protection
https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-investigate-risk
[8] Microsoft Learn — Microsoft Entra Conditional Access
https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/overview