Synthetic demo case · C-0002
Failed sign-ins followed by a success
A burst of failed sign-ins from one address, then a successful sign-in. The evidence is a single Entra sign-in export; no directory audit log was supplied, so changes to the account are not assessed.
- Evidence
- Microsoft Entra sign-in export (JSON)
- Findings
- 1 (highest severity high)
- Events
- 21
- Stated unknowns
- 12
Findings and citationsClient reportEntra sign-in log analysisAll demo cases