Email notifications for risky sign-ins when user confirmed MFA

We had an incident where user's credentials were compromised, attacker logged in from another country and the user accepted MFA notification (Microsoft Authenticator). We didn't see alert in Defender, most likely because the user confirmed MFA prompt and we would like to receive email alerts in cases like this. So, interactive logins from an unfamiliar/foreign IP where user is tricked into accepting MFA prompt. Is this possible?