Northwind Traders
Risky sign-ins need Entra ID P2 (Identity Protection, included in Microsoft 365 E5 or as an add-on); without it Microsoft hides sign-in risk.
Accounts that failed to sign in 5 or more times in the last 7 days (MFA and other prompts aren't counted). Many wrong passwords from several addresses or countries is someone guessing the password. If the person didn't make them, make sure MFA is enforced for the account and check any success that followed.
| Account | Failed | Wrong password | Locked out | Succeeded | Addresses | Countries | Last failure (UTC) | Last failure reason |
|---|---|---|---|---|---|---|---|---|
| robert.hughes@northwindtraders.example high | 9 | 8 | 1 | 0 | 3 | RU, GB, BR | 9 Oct 2026, 09:00 | Account is disabled |
Addresses that failed against several accounts, or 5 or more times. One address trying 5 or more accounts is password spraying. Successful sign-ins from the same address can be the office's own internet connection (people mistyping), or a guess that worked: check which.
| IP address | Failed sign-ins | Wrong password | Accounts tried | Accounts | Countries | Successful sign-ins from here | Last failure (UTC) |
|---|---|---|---|---|---|---|---|
| 203.0.113.66 high | 5 | 4 | 5 | nobody@northwindtraders.example, g#EXT#@northwindtraders.exampleand 3 moreinfo@northwindtraders.example, robert.hughes@northwindtraders.example, ann.patel@northwindtraders.example | BR | 0 | 7 Oct 2026, 23:04 |
| 198.51.100.7 medium | 7 | 7 | 1 | robert.hughes@northwindtraders.example | RU | 0 | 8 Oct 2026, 02:20 |
Countries with less than 5% of the tenant's successful sign-ins, other than the main one. Travel explains most. If the person doesn't recognise one, someone else has their password (and got past any MFA): reset it and sign them out everywhere.
| Account | Country | Successful sign-ins | Failed | Cities | IP addresses | Apps | Last success (UTC) |
|---|---|---|---|---|---|---|---|
| ann.patel@northwindtraders.example medium | FR | 1 | 0 | Paris | 198.51.100.40 | Office 365 SharePoint Online | 9 Oct 2026, 21:40 |
| george.robinson@northwindtraders.example medium | FR | 1 | 0 | London | 203.0.113.22 | Microsoft Office | 7 Oct 2026, 16:41 |
| megan.lee@northwindtraders.example medium | FR | 1 | 0 | London | 203.0.113.13 | Office 365 Exchange Online | 7 Oct 2026, 10:13 |
| grace.wilson@northwindtraders.example medium | IE | 2 | 0 | London | 203.0.113.18 | Office 365 Exchange Online, Microsoft Office | 9 Oct 2026, 11:18 |
| isla.evans@northwindtraders.example medium | IE | 1 | 0 | London | 203.0.113.30 | Microsoft Teams | 5 Oct 2026, 14:56 |
| leo.evans@northwindtraders.example medium | IE | 1 | 0 | London | 203.0.113.20 | Microsoft Office | 7 Oct 2026, 07:29 |
| mia.hughes@northwindtraders.example medium | IE | 1 | 0 | London | 203.0.113.26 | Office 365 Exchange Online | 6 Oct 2026, 15:50 |
| owen.white@northwindtraders.example medium | IE | 1 | 0 | London | 203.0.113.15 | Office 365 SharePoint Online | 9 Oct 2026, 10:43 |
| amelia.watson@northwindtraders.example medium | US | 1 | 0 | London | 203.0.113.21 | Office 365 Exchange Online | 9 Oct 2026, 10:43 |
| george.roberts@northwindtraders.example medium | US | 1 | 0 | London | 203.0.113.41 | Microsoft Office | 9 Oct 2026, 18:02 |
| owen.taylor@northwindtraders.example medium | US | 1 | 0 | London | 203.0.113.31 | Microsoft Teams | 9 Oct 2026, 07:51 |
| rhys.clark@northwindtraders.example medium | US | 1 | 0 | London | 203.0.113.36 | Office 365 Exchange Online | 7 Oct 2026, 07:05 |
| rhys.moore@northwindtraders.example medium | US | 1 | 0 | London | 203.0.113.27 | Microsoft Teams | 8 Oct 2026, 12:15 |
Successful sign-ins that needed only a password. Conditional Access exclusions, trusted locations and apps a policy doesn't cover show up here; the MFA coverage report shows why each account isn't asked. Flagged: accounts that never used MFA in this period.
Why sign-ins didn't complete. Prompts (MFA, "Stay signed in?") are recorded by Microsoft as failures but are part of a normal sign-in.
| Error code | Kind | Sign-ins | Accounts | Last seen (UTC) |
|---|---|---|---|---|
| 50126 | Failure | 27 | 16 | 9 Oct 2026, 17:59 |
What it means: Wrong user name or password | ||||
| 50074 | Prompt | 21 | 15 | 10 Oct 2026, 07:01 |
What it means: Asked to complete MFA | ||||
| 50140 | Prompt | 13 | 11 | 10 Oct 2026, 07:02 |
What it means: Interrupted by the "Stay signed in?" prompt | ||||
| 50034 | Failure | 1 | 1 | 7 Oct 2026, 23:04 |
What it means: No such account in this tenant | ||||
| 50053 medium | Failure | 1 | 1 | 8 Oct 2026, 02:20 |
What it means: Locked out: too many wrong passwords (smart lockout), or the address is known to be malicious | ||||
| 50057 | Failure | 1 | 1 | 9 Oct 2026, 09:00 |
What it means: Account is disabled | ||||
| 53003 | Failure | 1 | 1 | 10 Oct 2026, 16:00 |
What it means: Blocked by Conditional Access | ||||
Where sign-ins came from, by Microsoft's location for the address. Flagged: countries the tenant rarely signs in from.
What people signed in to. "Without MFA" counts successful sign-ins that needed only a password.
Every account that signed in interactively in the last 7 days. Open an account for the rest of what Office Sentry knows about it.
| Account | Sign-ins | Succeeded | Failed | Prompts | With MFA | Without MFA | Countries | Apps | Last sign-in (UTC) | Last failure reason |
|---|---|---|---|---|---|---|---|---|---|---|
| ethan.green@northwindtraders.example | 9 | 6 | 0 | 3 | 4 | 2 | GB | Office 365 Exchange Online, Office 365 SharePoint Onlineand 2 moreMicrosoft Office, Microsoft Teams | 9 Oct 2026, 14:19 | |
| olivia.smith@northwindtraders.example | 6 | 6 | 0 | 0 | 5 | 1 | GB | Microsoft Teams, Office 365 Exchange Online, Office 365 SharePoint Online | 10 Oct 2026, 14:16 | |
| sophie.smith@northwindtraders.example | 6 | 6 | 0 | 0 | 5 | 1 | GB | Microsoft Teams, Office 365 Exchange Online | 9 Oct 2026, 18:26 |
Interactive sign-ins since 2026-10-05, from the Entra ID sign-in log. Background sign-ins by apps and saved sessions aren't included. Times are UTC.
Data from Sign-in activity (), Tenant profile and licences ().