Lesson 152 — The Same Account Accessed SharePoint From Two Countries

Case briefing

Stage 1 — reconstruct SharePoint activity by source IP

Begin with the Microsoft 365 audit activity. Preserve the client IP, operation, site and user agent so the SharePoint events can later be compared with Entra sign-ins.

let TargetUser = "alex.wilson@contoso.com";
OfficeActivity
| where TimeGenerated > ago(24h)
| where UserId =~ TargetUser
| where OfficeWorkload == "SharePoint"
| project TimeGenerated,
          UserId,
          Operation,
          Site_Url,
          SourceFileName,
          ClientIP,
          UserAgent
| order by TimeGenerated asc

Stage 2 — examine the account's Entra sign-ins

Now query SigninLogs for the same user and time period. Keep IP, location, application, client type, device details, Conditional Access and authentication requirements visible.

let TargetUser = "alex.wilson@contoso.com";
SigninLogs
| where TimeGenerated > ago(24h)
| where UserPrincipalName =~ TargetUser
| project TimeGenerated,
          UserPrincipalName,
          IPAddress,
          Location,
          AppDisplayName,
          ClientAppUsed,
          DeviceDetail,
          ConditionalAccessStatus,
          AuthenticationRequirement,
          ResultType
| order by TimeGenerated asc

Stage 3 — correlate SharePoint IPs with sign-in evidence

Use the IP addresses seen in SharePoint activity as pivots into Entra sign-ins. This helps test whether the application activity and authentication activity belong to the same source patterns.

let TargetUser = "alex.wilson@contoso.com";
let SharePointIPs =
    OfficeActivity
    | where TimeGenerated > ago(24h)
    | where UserId =~ TargetUser
    | where OfficeWorkload == "SharePoint"
    | summarize by ClientIP;
SigninLogs
| where TimeGenerated > ago(24h)
| where UserPrincipalName =~ TargetUser
| where IPAddress in (SharePointIPs)
| project TimeGenerated,
          IPAddress,
          Location,
          AppDisplayName,
          ClientAppUsed,
          ConditionalAccessStatus,
          AuthenticationRequirement,
          ResultType
| order by TimeGenerated asc

Stage 4 — establish the user's normal geography

Look back 30 days and summarise where the account normally signs in from. This gives the two-country observation a behavioural baseline.

let TargetUser = "alex.wilson@contoso.com";
SigninLogs
| where TimeGenerated > ago(30d)
| where UserPrincipalName =~ TargetUser
| summarize SignIns=count(),
            FirstSeen=min(TimeGenerated),
            LastSeen=max(TimeGenerated),
            IPs=make_set(IPAddress, 50),
            Apps=make_set(AppDisplayName, 50)
          by Location
| order by SignIns desc

Stage 5 — build the combined cloud timeline

Finally, normalise the sign-in and SharePoint evidence into one chronological view. This allows the investigation to compare authentication and application activity side by side.

let TargetUser = "alex.wilson@contoso.com";
let StartTime = datetime(2026-08-18 10:00:00);
let EndTime = datetime(2026-08-18 16:30:00);
union
(
    SigninLogs
    | where TimeGenerated between (StartTime .. EndTime)
    | where UserPrincipalName =~ TargetUser
    | project TimeGenerated,
              EvidenceType="Sign-in",
              Source=IPAddress,
              Detail=strcat(AppDisplayName, " | ", tostring(Location),
                            " | CA=", tostring(ConditionalAccessStatus))
),
(
    OfficeActivity
    | where TimeGenerated between (StartTime .. EndTime)
    | where UserId =~ TargetUser
    | where OfficeWorkload == "SharePoint"
    | project TimeGenerated,
              EvidenceType="SharePoint",
              Source=ClientIP,
              Detail=strcat(Operation, " | ", Site_Url,
                            " | ", SourceFileName)
)
| order by TimeGenerated asc

Agent Foskett's two-country timeline

Your evidence board

Write the finding like an investigator

Example: Microsoft 365 audit and Microsoft Entra sign-in telemetry recorded SharePoint activity for alex.wilson@contoso.com from IP addresses geolocated to two different countries during the same investigation window. The SharePoint client IPs were correlated with sign-in records and reviewed alongside application, client, device, Conditional Access and authentication context. The second country was not observed in the account's recent 30-day sign-in baseline. This geographic inconsistency, occurring during the same period as unusually large pre-departure downloads, supports escalation for possible session or account compromise. The evidence does not, by itself, establish impossible travel or malicious access; VPN, proxy, device and geolocation factors should be validated before reaching a stronger conclusion.

Lesson 152 key takeaways

• Correlate Microsoft 365 application activity with Entra sign-in telemetry.
• Preserve IP, location, application, client, device and authentication context.
• A successful sign-in does not prove the legitimate user performed it.
• A passed Conditional Access result does not automatically prove a session is trustworthy.
• Use SharePoint client IPs as pivots into identity telemetry.
• Historical geographic baselines help identify genuinely unusual access patterns.
• VPNs, proxies and geolocation errors can create misleading country changes.
• Do not label an event impossible travel based on country names alone.
• Build one chronological view of sign-in and application evidence.
• Write the conclusion at exactly the strength supported by the combined evidence.

Module 13 — the cloud investigation continues

Lesson 151 identified unusually large data collection before resignation. Lesson 152 now adds geographic inconsistency to the account's SharePoint activity. Next we examine a much sharper behavioural spike: hundreds of files downloaded in only eleven minutes.