Set up the azure integration.
Detect and identify the network IP address when multiple user accounts failed to complete the MFA process.
Monitor Azure Active Directory Sign-in logs and detect when any @evt.category
is equal to SignInLogs
, @properties.authenticationRequirement
is equal to multiFactorAuthentication
and @evt.outcome
is equal to failure
.