For example, in the extract, we see these 3 entries when Migration Admin couldn't log in, whereas in successful one third is for miry\administrator (successful login). Do you see such entries in IIS logs WHEN 401 is given? Where exactly is the 401 given (endpoint/ move request)?
IIS Logs
---------
2019-08-28 07:19:05 192.168.2.50 POST /EWS/mrsproxy.svc - 443 - 4.4.0.1 - 401 0 0 2390
2019-08-28 07:19:10 192.168.2.50 POST /EWS/mrsproxy.svc - 443 - 4.4.0.1 - 401 1 2148074254 0
2019-08-28 07:19:10 192.168.2.50 POST /EWS/mrsproxy.svc - 443 - 4.4.0.1 - 401 1 2148074252 46
Successful
2019-08-28 06:57:38 192.168.2.50 POST /EWS/mrsproxy.svc - 443 - 4.4.0.1 - 401 0 0 0
2019-08-28 06:57:42 192.168.2.50 POST /EWS/mrsproxy.svc - 443 - 4.4.0.1 - 401 1 2148074254 15
2019-08-28 06:57:42 192.168.2.50 POST /EWS/mrsproxy.svc - 443 miry\administrator 4.4.0.1 - 200 0 0 125