MicrosoftTruly, AdminDroid is the most efficient way to create a weekly failed login report. It is cost effective and also provides in the login failure report cases where the username is invalid on the tenant. This is handy because you can see the password spray attempt.
My issue with this is that I have a case where a user saw an unsuccessful login attempt without session data but it also trigged an MFA challenge. In this case the app was the Office 365 Management app on an Apple iPhone running the very old iOS 12 as shown below.
Needless to say we have a robust CA policy in place for foreign locations and unusual travel, so regardless of the employee affirming the phantom MFA request they never would have gotten in. However, my question is, why did the failed password attempt successfully raise an MFA challenge? Shouldn't this only happen after a successful password attempt?
