Managed Sentinel – Alert 194
| Alert ID | MS-A194 |
| Alert Name | Sign-ins from IPs that attempt sign-ins to disabled Azure accounts |
| Description | This alert identifies IPs with failed attempts to sign in to one or more disabled accounts signed in successfully to another account. |
| Severity Level | Medium |
| Threat Indicator | |
| MITRE ATT&CK Tactics | Credential Access |
| Log sources | SigninLogs |
| False Positives | |
| Recommendations |