Invalid/Incorrect failed logon activity logs getting captured

[FlyingCoffee]

Hi All,

I am observing failed logon activity logs for SharePoint whenever I am trying to signing. However, I didn't face any issues during sign-in. I wonder how these failed logon are being captured. Did anyone facing the same issue with mcas, unknown or incorrect failed logon activity.

Below are the sample failed logons on my ID, that didn't occur. 

[#2]

@FlyingCoffee anytime there is an error code in a login we ingest then it will be classified as a failed login. For these items it looks like it’s part of MFA flow where a login flow is interrupted either for MFA prompt or the keep me signed in check box.