MFA anomaly alert received: How to confirm risks without accidentally locking out employee accounts

I once encountered a situation where a sales colleague kept receiving MFA push notifications, while the SIEM simultaneously flagged failed login attempts from a different location. It's easy to just disable the account when you first see the alert, but he was on a business trip in another state using hotel Wi-Fi, so I couldn't jump to conclusions based solely on geography. My approach was to…