IP addresses and Risky Login

Good Morning, I am responsible for running Secure Score Reports for our clients. I was running down "suspicious" logins and when I reached out to our client's users asking if they were in XXX at YYY date and ZZZ time, I am generally being told they were not in that location. One user was in Jacksonville Florida and is showing IPs based out of Orlando and Mobile. I am at a loss in determining if these logins are legitimate or not. The information in the report indicates there was MFA. Is there a way to get a list of IP addresses that O365/Azure use for Multifactor Authentication? Please advise and thank you!