Managed Sentinel – Alert 194

Alert IDMS-A194
Alert NameSign-ins from IPs that attempt sign-ins to disabled Azure accounts
DescriptionThis alert identifies IPs with failed attempts to sign in to one or more disabled accounts signed in successfully to another account.
Severity LevelMedium
Threat Indicator
MITRE ATT&CK TacticsCredential Access
Log sourcesSigninLogs
False Positives
Recommendations