Multiple Failed SignIn Events

[Qusai_Ismail]

Hello,

There are more than 100 failed sign in events from authorised device with interval 2m related to these three Application:

- Office Online Maker SSO

- Office Online Core SSO

- Office365 Shell WCSS-Client

For what these application related to?

Thank you,

[#2 · Accepted solution]

They are all 1st party Microsoft applications.

Office 365 Shell WCSS-Client is the browser code that runs whenever a user navigates to most Office365 applications in the browser.

Office Core and Maker SSO are what they say on the tin, single sign-on applications.

https://github.com/MicrosoftDocs/SupportArticles-docs/blob/main/support/azure/active-directory/verif...

This article has a list of 1st party apps and methodology on verifying.