The incident/escalation page for unexpected M365 logins shows countries, VPN, browsers, but not IP address(es).

Would be very handy to have the list of IPs on this same page.

Recently we had a false positive, and had to go into Entra logs to review, only to realize it was our own IPs.