Product: ITDR: Huntress Managed Identity Threat Detection and Response
Environment: Unwanted Access
Summary: The Unwanted Access capability targets adversary tradecraft that attempts to maliciously gain access to partner or customer Microsoft 365 tenants and Google Workspace environments. This access usually occurs through the utilization of stolen credentials (username/password) or stolen session tokens.

Detections

Session Token Theft Detection

Session Token Theft is adversary tradecraft that focuses on stealing and re-using an active Microsoft session token to gain unwanted access to an identity. Session token theft can bypass MFA. Huntress detects session token theft by looking at changes in key attributes between login events within the same session.

Credential Theft Detection

Credential Theft is an adversary tradecraft that focuses on stealing the username and password associated with an identity. Credential theft can be mitigated by MFA, but many businesses still do not enforce MFA. Huntress detects credential theft by monitoring all non-MFA logins and identifying login events with new attributes.

Malicious Datacenter / Residential Proxy Detection

Huntress tracks anomalous and abuse-prone datacenter and residential proxy logins and generates critical incident reports when the SOC detects such activity for an associated identity. Huntress looks for deviations from normal login patterns for identities and uses its own threat intelligence to reduce false positives from benign datacenter activity.

Functionality

Unwanted Access Dashboard

The Unwanted Access dashboard is accessible from the left navigation bar in the Huntress portal. Huntress users can use this dashboard to review login locations and VPN activity at the account level or organization level for all integrated tenants across their Huntress account.

Clicking the number icon for a country of interest opens a drawer showing all logins from that country and whether those logins have generated escalations for your review. Logins with pending escalations can be resolved from this view.

Unwanted Access Dashboard - Country Logins

Unexpected Country/VPN Escalations

New login events from countries that do not match any existing Unwanted Access Rule and do not match an identity’s Microsoft Entra License Usage Location will trigger an Unexpected Country escalation in the Huntress portal. Identities without a usage location will pull one from the tenant environment's default country.

As of August 19, 2026, escalations are now generated per identity and no longer roll up to the organization level. This change enables better integration with the Huntress platform notification system and provides better visibility into new escalation events.

New login events from anonymous VPN providers that do not match an existing Unwanted Access Rule will trigger an Unexpected VPN escalation within the Huntress portal. Huntress DOES NOT generate escalations for enterprise-grade VPNs or SASE providers. These escalations roll up all unexpected logins for that VPN and Huntress identity into the same escalation. New, unexpected VPN logins will continue to be added to the escalation until the escalation is resolved by creating a rule.

When onboarding a new Microsoft 365 tenant or GWS environment to Huntress ITDR, Huntress will pause new escalation generation after five escalations have been generated for a particular country or VPN. This pause will remain in effect for 24 hours. Huntress will send a notification when this pause occurs.

Unexpected Login Escalation Resolution

Huntress users can resolve an escalation in several ways. Learn more about resolving escalations in the Unwanted Access Escalation Resolution Instructions article.

Escalation resolution has three pathways:

Unauthorized

This activity is NOT authorized for this identity, organization, or the entire account. Huntress will make no further determination on malice against these logins and will automatically revoke sessions and disable identities logging in from this location or VPN.

Unauthorized rules triggered by escalations will (by default) generate a Critical incident report, revoke sessions, and disable the associated identity. This functionality can be disabled at rule creation if desired.

Expected

Activity from this location, VPN, or IP is expected. Huntress will not generate future escalations that match these criteria and will factor this rule in when evaluating logins for malice.

Escalations can be resolved as Expected with an IP rule from the escalation view. Users can select a specific IP from the list of IPs associated with the escalation. The user can create a rule for only one IP from this view, even if multiple IP addresses were involved in the escalation activity. Additional rules can be configured in the Unwanted Access rules view.

Dismiss

The Huntress user would prefer not to classify this activity as either Expected or Unauthorized and would simply like to dismiss the escalation. The next login event from this location or VPN for this identity will trigger another escalation.

Unwanted Access Rules

ITDR Unwanted Access Configuration Rules allow Huntress users to set locations and VPNs as explicitly Unauthorized or Expected. These rules also allow users to set specific IPs (IPv4 or IPv6) or IP CIDR ranges as Expected. Expected rules will prevent the generation of new escalations and will serve as a data point for the SOC in determining the malicious nature of anomalous activity. Expected rules may have a start and end date to cover identity travel. Unauthorized rules may not have a start or end date.

Rules created at the identity level will override those set at the organization level, which in turn override those set at the account level.

Review the Unwanted Access Configuration Rule Creation Instructions article for more information.

Unwanted Access Policies

The Unwanted Access Policies menu allows for configuration of settings related to ITDR identity logins. Here, users can configure Deny All policies for locations and VPNs, as well as Trusted Device Escalation Suppression.

Huntress users can toggle Deny All Locations and Deny All VPNs at the account level, and override account-level settings for specific Huntress organizations on the organization-level Unwanted Access rules page. By default, Deny All Locations and Deny All VPNs are toggled off.

The Deny All Locations policy affects all logins from all countries that are neither subject to Expected rules nor the default usage location for the tenant(s) or identities. This toggle will generate critical ITDR incident reports for these countries and revoke sessions and disable identities logging in from these countries.

The Deny All VPNs policy affects all logins from anonymous VPNs that are not subject to the Expected rules. This toggle will generate critical ITDR incident reports for these VPNs, revoke sessions, and disable identities logging in from these VPNs.

Trusted Device Escalation Suppression

This allows Huntress users to suppress escalations for identities logging in from certain types of trusted devices. Logins from these devices for affected identities will not generate any escalations regardless of location or VPN used for login.

Compliant Devices

Compliant devices are managed devices that comply with tenant policies. Huntress identifies these devices through the Unified Audit Log parameter IsCompliant.

ITDR accounts created after July 28, 2026, have this functionality toggled ON by default.

Joined Devices

Joined devices are managed devices that are added by a tenant administrator. Huntress identifies these devices through the Unified Audit Log parameter TrustType. Devices with a TrustType value of "1" or "2" are considered joined devices.

ITDR accounts created after July 28, 2026, have this functionality toggled ON by default.

Registered Devices

Registered devices are devices recognized by the tenant but that have been added by end users. Huntress identifies those devices through the Unified Audit Log parameter TrustType. Devices with a TrustType value of "0" are considered registered devices.

This functionality is toggled OFF by default for all accounts.

Common Scenarios and Limitations

A user has more than one trip to the same country

Each identity can have only one rule per country. You can’t schedule two separate rules (e.g., two December trips to the US) for the same user. Instead:

Create one rule with a start date at the beginning of the first trip and an end date at the end of the last trip, or
After the first trip, edit the existing rule’s start and end dates to cover the next trip. Dates and notes can be edited; other fields can’t.

My VPN isn’t in the drop-down list

Enterprise VPNs and SASE providers don’t generate Unexpected VPN escalations, so they don’t need a rule.
Consumer or anonymous VPNs that aren’t listed: create an Expected IP rule for the VPN’s egress IP address or CIDR range.
Unexpected labels: VPN names come from a third-party data provider. Services owned by the same parent company may appear under a single name.

I want an identity-level exception for one VPN (e.g., NordVPN)

Add Rule → Rule Level: Identity → Rule Type: Expected → choose the VPN. Rules at the identity level override organization- and account-level rules.

I want fewer notifications for a client without turning off protection

Deny All Locations / Deny All VPNs don’t reduce alerts. They do the opposite: matching logins create Critical incident reports, revoke sessions, and disable the identity.
To reduce noise from managed devices, use Trusted Device Escalation Suppression (for Compliant, Joined, or Registered devices).
To change notification settings, see Huntress Platform - Notification Categories and Routing

What Each Control Does

Control	Creates escalations?	Disables identity?
Expected rule	No	No
Unauthorized rule	Creates a Critical Incident Report	Yes, by default (can be turned off at rule creation)
Deny All Locations / VPNs	Creates a Critical Incident Report	Yes
Dismiss	Yes, on the next matching login	No
Trusted Device Suppression	No, for matching devices	No

ITDR: Unwanted Access Overview