Email notifications for risky sign-ins when user confirmed MFA

We had an incident where user's credentials were compromised, attacker logged in from another country and the user accepted MFA notification (Microsoft Authenticator). We didn't see alert in Defender...