Forum Discussion

Lloyd Adams's avatar
Lloyd Adams
Iron Contributor
Feb 08, 2018

Multiple Login Failures

I'm probably being really dense, but is there a report that will show accounts with multiple login failures? 

    • Lloyd Adams's avatar
      Lloyd Adams
      Iron Contributor

      Thanks.  Don't have Azure AD Premium, and the first link requests that I start a free trial to use it.

  • Cian Allner's avatar
    Cian Allner
    Silver Contributor

    Not quite what you are after but there used to be a 'Sign-ins after multiple failures' Azure Active Directory report which is being retired. 

     

    "The following Azure AD anomalous activity security reports are not included as risk events in the Azure portal:

    • Sign-ins after multiple failures
    • Sign-ins from multiple geographies

    These reports are still available in the Azure classic portal, but they will be deprecated at some time in the future."

     

    Much of the reporting has been consolidated on the new Azure AD Portal. The one that might be most useful for this is Sign-in activity reports (requires Azure AD Premium).  One of the options is to filter based on sign-in status failure or success.

     

    Risky sign-ins and Users flagged for risk reports are available at no additional cost, though with AAD Premium "enabling you to examine some of the underlying risk events that have been detected for each report".

     

    • Risky sign-ins - A risky sign-in is an indicator for a sign-in attempt that might have been performed by someone who is not the legitimate owner of a user account. For more details, see Risky sign-ins.

    • Users flagged for risk - A risky user is an indicator for a user account that might have been compromised. For more details, see Users flagged for risk.

    The Azure Active Directory Power BI Content Pack may be worth looking at as well, as it has a Sign-ins by location and users section and can help find events like was the sign-in successful.

     

    Hope some of that is of use.

    • Hans Van Damme's avatar
      Hans Van Damme
      Copper Contributor

      This is not really answering the question of the original poster. I, too, am interested in a report that tells me "successful logins after multiple failures".

       

      Secure score refers to this report, but it doesn't seem to exist any more.

    • Lloyd Adams's avatar
      Lloyd Adams
      Iron Contributor

      Thanks for those pointers.  Users flagged for risk requires premium license to get any details.

       

      Rapidly coming to conclusion that without Premium you are pretty much in the dark

Resources