I am having trouble understanding what O365's audit log believes is a "User Logged In" event. Is this a user signing into portal.office.com after they've been logged out, or does a "log in" count when a cloud/desktop app linked to their O365 account is opened, such as Word Online or Excel's desktop app?
Thanks!
