Multiple failed logins from random IPs - how is the bad actor attempting to login?

In Azure I can see a lot of failed recurrent login attempts for users from random IP addresses. They try constantly (every 5 seconds) for a few days then give up.

My question is how are the bad actors attempting these logins? Its presumably some script of some sort and they are brute forcing the PW. And how do I find that in Azure? And how do I stop it?

actor addresses azure bad bad actors cybersecurity ip addresses ips login login attempts logins question random