Forum Discussion
User with hundreds of Interactive Sign-In log entries that are "Interrupted"
I have one user in our organization that has hundreds of Interactive Sign-in logs in EntraID that are marked as "Interrupted". I don't even know where to start with the user. Does anyone have a recommendation for isolating the cause of these logs? Recent entries are 95% related to Office Online Core SSO application.
I'm looking at a similar issue, a small subset of users with hundreds of Office Online Core SSO sign-in events, a mix of Interrupted and Failure. All are from Safari on macOS. The users are not seeing interactive sign-in prompts on their devices. As far as I know, everything looks normal on their end, and they're using M365 without issue.
The Interrupted events are due to MFA requirement, but MFA is not triggering. The Failures are "Silent interrupt required to recognize browser capabilities".
Check the details for few of these. The interrupt can be due to CA policies kicking it, MFA registration, SSPR registration, etc.
