Abnormal logins for a user

Hi @rp-8870,

Azure AD shows an information about the usage of managed applications and user sign-in activities.

If you don't recognize logins, I recommend user to change a password.

https://video2.skills-academy.com/en-us/azure/active-directory/reports-monitoring/concept-sign-ins

It's also good to require MFA by using Conditional Access.

https://video2.skills-academy.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-all-us

@rp Thanks for reaching out. With a large set of work that AAD does, tracking sign-in usage of end users is one of them. While many of them can be normal and expected due to multiple services login in short time, if you think that there is some malicious entry of sign in attempt or something which does not match the pattern, you should investigate it more closely with the help of end user.

We do provide Sign-In reports which captures multiple information regarding a particular sign in like :
The sign-in date
The related user
The application the user has signed in to
The sign-in status
The status of the risk detection

As a precaution to allow only verified users, MFA can be enabled to increase the security. Followed by changing passwords for end user in order to mitigate any further risk, if found compromised. If you need any more help, please let us know.

-----------------------------------------------------------------------------------------------------------------

If the suggested response helped you resolve your issue, do click on "Mark as Answer" and "Up-Vote" for the answer that helped you for benefit of the community.