How to Investigate a Security Alert for a New Login From an Unmanaged Device

A login from an unmanaged device can be legitimate or indicate stolen credentials. The account may be protected by MFA while still accessing data from an endpoint outside the organization’s controls.

What to check

Confirm user and device context, authentication strength, access policy, data viewed or downloaded, session lifetime, and whether the device is newly registered. Compare with recent support requests and travel.

Recommended next step

Apply the organization’s conditional access and incident procedures, revoke sessions if unauthorized, and help the user enroll an approved device when legitimate. Assess data exposure before closing the alert.

How Informatix Systems can help

Informatix Systems provides security operations and endpoint security services. We can assess the affected environment, narrow down the failure, and help plan a practical correction. Contact us with the system involved, when the issue began, and non-sensitive error details.