Anomalous login detection, often called "impossible travel," flags sign-ins that come from two locations too far apart to be reached in the time between them. For example, a login from Durham, North Carolina followed 30 minutes later by a login from Singapore is not physically possible, so Warrant flags the second login as suspicious.
This adds a layer of protection on top of Warrant's existing controls, including account lockout and multi-factor authentication, and helps catch account compromise even when an attacker has valid credentials.
This guide explains how the feature works, what your users will experience, and how to configure it.
How It Works
When someone signs in, Warrant compares the approximate location and time with their previous sign-in. If the two are too far apart to travel between in the time available, the login is treated as impossible travel.
A few logins are never flagged:
A user's first login
Logins from a nearby or local area
Logins where a location cannot be reliably determined
Configure Detection Mode
Anomalous login detection is managed by super admins.
In the left sidebar, click Settings
Under Members, select Access & security
In the Anomalous-login detection card, choose a Detection mode:
Alert – Flagged logins are recorded and your security team is notified, but users are not challenged or blocked. This is the default.
Enforce – Flagged logins are actively challenged or blocked.
Off – Detection is disabled. No events or alerts are generated.
Your choice saves as soon as you select it.
Only super admins can see the Anomalous-login detection card, so other admins will not find it on the page.
What Users Experience
Most users will never notice this feature. Normal travel, consistently used VPNs, and everyday logins will not trip it.
When a login is flagged under Enforce mode, the result depends on how the user signs in:
Password login – The user is asked to complete an email verification check. After completing the link sent to their email, the login finishes normally.
Single sign-on (Google or Microsoft) – The flagged login is denied and the user is returned to the login page.
A flag is usually caused by a recent flight, a VPN that changed the user's apparent location, or a sign-in from a new country. Completing the email verification, or contacting an administrator, resolves it.
Reduce False Flags
A few common situations can flag a legitimate login. To minimize disruption:
Ask users on VPNs to keep a consistent region rather than switching exit locations mid-session
Expect that long-distance air travel can briefly flag a login right after landing. The email verification step under Enforce is designed to handle this smoothly.
Start in Alert mode if your team travels internationally often, so you can observe activity before turning on Enforce