Set up account lockout and alerting for suspicious sign-ins

Microsoft Entra and Google Workspace can both flag or block sign-ins from unusual locations, impossible travel (logging in from two countries within minutes), or after repeated failed attempts. Turn on sign-in risk alerts so someone actually gets notified, not just a log entry nobody reads.

Coach's tip: test it by asking your IT support to trigger a simulated risky sign-in — it's the only way to know the alert actually reaches someone.