When reviewing Failed log on events in MCAS (from Azure ATP), user info is often not visible in the list.
It would be so much easier if the sourceAccountName is always displayed in the User column. Now we have to click each item to open and see the sourceAccountName in the activity object (upon hovering) when it's a computer object or an unkown user.
