What are common causes of sign-in failures and interruptions in Microsoft 365?
While accessing the sign-in logs in Microsoft 365, you will encounter three types of sign-in statuses: Success, Failure, and Interrupted. The ‘Success’ state represents sign-ins that were completed successfully. ‘Failure’ and ‘Interrupted’ statuses indicate unsuccessful sign-in attempts due to various reasons.
Microsoft 365 failed sign-ins
Failed sign-ins in Microsoft 365 occur when users are unable to access their accounts. Common causes of failed sign-ins in Microsoft 365 include:
- Incorrect credentials: When the user enters the incorrect password.
- Account lockout: If the user account is locked due to multiple failed login attempts.
- Multi-factor authentication: When the user fails to pass the required multi-factor authentication process.
- Conditional access policies: When the sign-in does not meet the conditions specified in the CA policies, such as sign-ins through unmanaged devices, non-compliant devices, network locations, etc.
- Disabled account: When the sign-in was blocked for the user.
- Expired password: When the user's password expires due to an expiration policy.
- Network issues: If connectivity problems prevent the M365 user from reaching the authentication server.
Microsoft 365 interrupted sign-ins
Interrupted sign-ins are sign-in attempts that are not completed due to an interruption in the authentication process. These interruptions can occur for several reasons:
- User action: The user navigates away from the login page before completing the sign-in process.
- Timeouts: The sign-in process takes too long, and the session times out before authentication completes.
- Client-side issues: Problems in the device or browser, such as crashes or closing the tab prematurely.
- External authentication: Issues in federated authentication where the process is handed off to another provider but fails to complete.
For proactive security measures, effortlessly discover the list of failed or interrupted sign-ins for Microsoft 365 users using AdminDroid.
- With all users’ sign-in report, access details such as sign-in ID, sign-in time, username, signed-in application, authentication details, IP address, risk details, etc.
- Use the Sign-in Status filter to easily view the failed logins, interrupted logins, and successful logins separately.
![failed-and-interrupted-signins](../images/how-to-images/azure/audit-failed-sign-ins/failed-and-interrupted-signins.png?v=5110_21)
Pro Tip: Make use of the Sign-in Type filter to analyze the interactive as well as non-interactive sign-ins.