Multiple SaaS Connections From different IPs.
This event provides the ability to observe user login behavior across multiple applications. It can commonly occur with two or three different applications.
i.e. Teams on a computer, Outlook on a phone, and Slack on a tablet.
If the data appears odd or suspicious it is recommended the customer be contacted to confirm.