Forum Discussion
When i see Log On activity from another country.
When i see a Log On activity, has the account been compromised or is this logging failed attempts?
It seems a lot of my students are logging in from China?
Please help me understand.
3 Replies
As Vasil says, you need to check whether they're failed or successful logins.
But to answer what might be part of your question, yes it's pretty normal to see lots of login attempts from other countries. If you are securing your identities with MFA and/or conditional access, and potentially also with Azure AD Identity Protection, you should have little to worry about.
Depends on what you are lookin on, but the failed logon attempts will be named accordingly:
Failed log on (Failure message: General failure)
Looking at the event details (General tab) should give you move information.
VasilMichev I can't see any "Event Details" under the general tab?
