The "Activity from infrequent country" anomaly detection policy is designed to identify when a user performs an activity from a country/region that has not been recently, or ever, visited by any user in the organization. The system establishes a baseline of normal activity based on the locations of all users. A sign-in from a location that is new to the entire organization triggers this specific alert, directly matching the requirement to be notified when a user signs in from a location never used by others in the organization.

A. Impossible travel: This policy detects when a single user signs in from two geographically distant locations in a time frame that is too short to physically travel between them.

B. Activity from anonymous IP addresses: This policy triggers an alert when a sign-in originates from an IP address associated with an anonymizing service like a VPN or the Tor network, regardless of the location's history.

D. Malware detection: This is not a standard anomaly detection policy name. The related policy, "Activity from suspicious IP addresses," detects sign-ins from IPs known to be malicious (e.g., botnets), not new locations.

1. Microsoft Learn. (2023). Anomaly detection policies in Microsoft Defender for Cloud Apps. "Activity from infrequent country" section. This document states

"This detection identifies when an activity is performed from a country/region that was not recently or never visited by any user in the organization."

2. Microsoft Learn. (2023). Anomaly detection policies in Microsoft Defender for Cloud Apps. "Impossible travel" section. This document states

"This detection identifies two user activities... originating from geographically distant locations in a time period shorter than the time it would have taken the user to travel..."

3. Microsoft Learn. (2023). Anomaly detection policies in Microsoft Defender for Cloud Apps. "Activity from anonymous IP addresses" section. This document states

"This detection identifies that users were active from an IP address that has been identified as an anonymous proxy IP address."