A San Luis Obispo–area multi-location business with remote staff started getting “unexpected country” and VPN-related identity alerts. Some were harmless. Some were not. The useful work was proving which was which before anyone hit dismiss.

Identity alerts are not noise until a human — with context — shows they are.

Approved remote work vs. something else

Remote staff travel. They use home networks. They sometimes land on VPN paths that look odd next to the office baseline. That can be legitimate.

It can also be token replay, a stolen session, or a password in the wrong hands. The difference rarely announces itself in the subject line of the alert. Someone has to compare the user, the device, the timing, and whether the person actually meant to sign in from there.

What a real review looks like

When an alert is not clearly approved remote work, the response is boring and thorough:

  • Rotate the password if there is any doubt the old one is clean.
  • Kill active sessions so a stolen token stops working.
  • Re-verify MFA methods on the account.
  • Audit mailbox forwards and inbox rules.
  • Confirm the device in play is still a company-managed one.

That is identity threat detection and response in practice — not a dashboard full of green checkmarks nobody reads.

Why multi-office teams feel this

Offices with people on the road generate more “unexpected” signals than a single locked storefront. Without review, two bad habits show up: ignore every alert, or panic at every alert. Neither protects the tenant.

Managed detection on the identity side exists so the office manager is not the SOC. Your IT company should already be triaging these, not forwarding raw alerts and asking you what to do.

We separated approved remote patterns from the ones that needed password rotation and session kill for that SLO-area team. The same review applies for Fresno and Clovis tenants with traveling staff. The point was not to invent drama. It was to stop treating every VPN label as either “fine” or “fire drill.”

What we do

We review unexpected-country and VPN identity alerts with human context, separate approved remote work from risky patterns, and follow through with password rotation, session revocation, MFA checks, and forward/rule audits when needed.

If your alerts pile up with no owner, reach out. We will tell you which signals matter in your tenant — and which ones already have a reason.