A service account in Entra ID has authenticated from an unfamiliar IP range associated with a residential ISP in another country. The login uses a legacy authentication protocol that bypasses conditional access evaluation — something the account technically still allows for with an older integration. In an environment generating hundreds of identity alerts daily, it joins a triage queue that the on-call analyst plans to review after lunch.