Identifies users with several AADSTS50074 (strong authentication required, the user did not pass the MFA challenge) or AADSTS500121 (authentication failed during the MFA challenge) sign-in results from the same IP address within one hour. One such row is often normal, for example a user who ignores a prompt once. A burst from an IP or country the user does not use can indicate MFA fatigue (an attacker with the password generating prompts), and a later successful sign-in from the same IP suggests the user approved a prompt they did not start. The threshold of 3 is a starting point, not a Microsoft number. Tune it against your own baseline. Each run looks at the last hour only, matching the hourly schedule, so one burst raises one alert and not one per run. Reference: https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-interactive-sign-ins

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.