How to Track Failed Login Attempts in Microsoft 365

While accessing the sign-in logs in Microsoft 365, you will encounter three types of sign-in statuses: Success, Failure, and Interrupted. The ‘Success’ state represents sign-ins that were completed successfully. ‘Failure’ and ‘Interrupted’ statuses indicate unsuccessful sign-in attempts due to various reasons.

Failed sign-ins in Microsoft 365 occur when users are unable to access their accounts. Common causes of failed sign-ins in Microsoft 365 include:

Interrupted sign-ins are sign-in attempts that are not completed due to an interruption in the authentication process. These interruptions can occur for several reasons:

• With all users’ sign-in report, access details such as sign-in ID, sign-in time, username, signed-in application, authentication details, IP address, risk details, etc.
• Use the Sign-in Status filter to easily view the failed logins, interrupted logins, and successful logins separately.

Pro Tip: Make use of the Sign-in Type filter to analyze the interactive as well as non-interactive sign-ins.

When users attempt to sign in to Microsoft 365 across various services, they may encounter different sign-in error codes. In such cases, Microsoft 365 users or admins can utilize the Error code lookup tool to find the cause of the error and the recommended actions to fix it.

As a Microsoft 365 admin, you can use MS Graph PowerShell to audit sign-in failures based on specific error codes. To do so, run the following cmdlet with the appropriate error code:

Get-MgAuditLogSignin -Filter "Status/ErrorCode eq <error_code>" | Select-Object –Property Id, CreatedDateTime, AppDisplayName, ResourceDisplayName, UserPrincipalName | Format-Table

• Utilize the Report Filtering capability in the failed user sign-ins report to filter the failed login attempts based on a specific error code.
• Filtering the report based on a specific error code assists you in identifying how frequently it's happening among your Microsoft 365 users.

Pro Tip: Once the filters are applied, use the Save as View option to save the customized report view for future use.

Monitoring failed MFA sign-ins is crucial for detecting unauthorized access attempts. Multiple MFA sign-in failures can indicate an attacker trying to bypass MFA. Monitoring these events enables quick responses to potential security breaches.

Follow the steps provided using the Entra admin center or PowerShell to track the MFA sign-in failures that have occurred in your organization.

Run the below cmdlet in MS Graph PowerShell to retrieve the sign-in failures due to MFA:

Get-MgBetaAuditLogSignIn -Filter "Status/ErrorCode ne 0 and AuthenticationRequirement eq 'multiFactorAuthentication'" | Select-Object –Property Id, CreatedDateTime, AppDisplayName, ResourceDisplayName, UserPrincipalName, IPAddress | Format-Table

• Identify the root cause and the specific reason for sign-ins failed due to MFA challenges in Microsoft 365.
• This report also gives you details, such as the time of MFA failure, user information, the application where the sign-in was attempted, the MFA authentication method used, etc.

Monitoring failed sign-ins due to conditional access policies can assist in identifying attempts from unmanaged devices or those that do not comply with organizational policies. This process helps identify suspicious login attempts that don't meet security requirements and enables admins to adjust policies to ensure legitimate sign-ins are not unnecessarily blocked.

• Go to the Microsoft 365 user's Sign-in logs page.
• Filter the Conditional Access field to view only the 'Failure' sign-ins due to CA policies in Microsoft 365 for the past 30 days.

Run the below cmdlet in MS Graph PowerShell to find the sign-ins that failed to meet the CA policy requirements.

Get-MgAuditLogSignIn -Filter "ConditionalAccessStatus eq 'failure'" | Select-Object –Property CreatedDateTime, Id, UserDisplayName, AppDisplayName, ConditionalAccessStatus, IPAddress | Format-Table

• AdminDroid's dedicated reports enable you to track sign-in failures due to CA policies based on user, location, application, browser, OS, and user type.
• Moreover, if a user experiences repeated sign-in failures, you can review the CA policies applied to the user to fix any configuration issues.

Pro Tip: Use the combination of ‘Ctrl + Shift + F’ to find any Microsoft 365 report in the AdminDroid portal.

Managing security is challenging, especially when protecting user accounts from brute-force and password spray attacks. Attackers often attempt multiple password combinations to gain unauthorized access to your resources. To prevent such suspicious sign-in activities, it's essential to have a robust policy that limits unsuccessful login attempts.

To lock the user account after several unsuccessful login attempts in Azure AD, you can use Smart Lockout. Follow these steps to configure the password protection policy:

Note: After configuring this policy, if a user experiences a specified number of consecutive sign-in failures, subsequent login attempts with the correct password will fail. This happens because the account is temporarily locked for the specified duration.

Microsoft 365 admins often need to block or unblock user sign-ins in various scenarios. Here are a few common reasons for disabling a user account:

Follow the steps below to block or unblock users from signing in to Microsoft 365.

• Click on the user you want to block or unblock from the Active users page.
• To block a user, click on the Block sign-in option, and enable the Block this user from signing in check box.
• Click the Save changes button.

Similarly, to unblock the user, uncheck the Block this user from signing in check box, and click the Save changes button.

Note: After blocking or unblocking a user, it may take up to 15 minutes for the changes to take effect.

To block or unblock user sign-ins in Microsoft 365, first connect to the MS Graph PowerShell with the user read-write permissions.

Connect-MgGraph -Scopes User.ReadWrite.All

Run the ‘Update-MgUser’ cmdlet with the parameter ‘AccountEnabled’ set to false to block Office 365 user sign-ins.

Update-MgUser -UserId <User_Id> -AccountEnabled:$false 

Similarly, to unblock the user from sign-in, use the same cmdlet with the parameter ‘AccountEnabled’ set to true.

Update-MgUser -UserId <User_Id> -AccountEnabled:$true

• AdminDroid's Disabled Users' Login Attempts report allows you to identify the sign-in attempts made by blocked users.
• Here, you can review blocked users' sign-ins with details, such as sign-in time, signed-in user, IP address, sign-in status, etc.

Handy Hint: Utilize the Schedule option available with the reports to receive regular insights via email in formats such as CSV, PDF, XLS, and more.