AL-771 and its companion alerts share an impossible-travel pattern. Check identity provider logs next.
