Tuning Microsofts Multiple Failed Login Attempts Alert

Hello Redditors,

My SOC has a Microsoft alert which creates an alert every time a users account has more than 25 failed login attempts. My organization also uses SSO and most of the time the alerts are triggered by an application timing out and then MFA prompts get sent to the users which they don’t accept. Sometimes when a user resets their password we get the alerts as well. Typically for analysis we are checking the IP reputation but not …

account alert alerts application cybersecurity hello login login attempts mfa microsoft organization prompts soc sso