So I am trying to hammer out the best process of handling impossible travel alerts and suspicious VPN activity.
In my current environment I dont have admin privileges to immediately disable user accounts or reset their passwords. I will be requesting some type of rights soon.
My thoughts around impossible travel is that when we see the alerts and they look suspicious then we can go to that usere account in Azure and force the user to MFA. But while digging around in Azure I realized its not setup like other IAM softwares to where you can force MFA. All I can see is revoke MFA sessions. Is that the same as forcing MFA?