Northwind Traders

Accounts that failed to sign in 5 or more times in the last 7 days (MFA and other prompts aren't counted). Many wrong passwords from several addresses or countries is someone guessing the password. If the person didn't make them, make sure MFA is enforced for the account and check any success that followed.

Addresses that failed against several accounts, or 5 or more times. One address trying 5 or more accounts is password spraying. Successful sign-ins from the same address can be the office's own internet connection (people mistyping), or a guess that worked: check which.

Countries with less than 5% of the tenant's successful sign-ins, other than the main one. Travel explains most. If the person doesn't recognise one, someone else has their password (and got past any MFA): reset it and sign them out everywhere.

Successful sign-ins that needed only a password. Conditional Access exclusions, trusted locations and apps a policy doesn't cover show up here; the MFA coverage report shows why each account isn't asked. Flagged: accounts that never used MFA in this period.

Why sign-ins didn't complete. Prompts (MFA, "Stay signed in?") are recorded by Microsoft as failures but are part of a normal sign-in.

Where sign-ins came from, by Microsoft's location for the address. Flagged: countries the tenant rarely signs in from.

What people signed in to. "Without MFA" counts successful sign-ins that needed only a password.

Every account that signed in interactively in the last 7 days. Open an account for the rest of what Office Sentry knows about it.