Google ITDR escalations are using Microsoft alert wording and templates. For example, Google login alerts show messages like “usage location provided by Microsoft”.

This is confusing in all environments:

If only Google is used, the Microsoft wording is misleading

If both are used, technicians cannot tell which identity provider triggered the alert without checking the portal

Google alerts should use Google-specific wording and clearly indicate the source (Google vs Microsoft) in the alert itself.