Not quite what you are after but there used to be a 'Sign-ins after multiple failures' Azure Active Directory report which is being retired.
"The following Azure AD anomalous activity security reports are not included as risk events in the Azure portal:
- Sign-ins after multiple failures
- Sign-ins from multiple geographies
These reports are still available in the Azure classic portal, but they will be deprecated at some time in the future."
Much of the reporting has been consolidated on the new Azure AD Portal. The one that might be most useful for this is Sign-in activity reports (requires Azure AD Premium). One of the options is to filter based on sign-in status failure or success.
Risky sign-ins and Users flagged for risk reports are available at no additional cost, though with AAD Premium "enabling you to examine some of the underlying risk events that have been detected for each report".
-
Risky sign-ins - A risky sign-in is an indicator for a sign-in attempt that might have been performed by someone who is not the legitimate owner of a user account. For more details, see Risky sign-ins.
-
Users flagged for risk - A risky user is an indicator for a user account that might have been compromised. For more details, see Users flagged for risk.
The Azure Active Directory Power BI Content Pack may be worth looking at as well, as it has a Sign-ins by location and users section and can help find events like was the sign-in successful.
Hope some of that is of use.
