Non-interactive sing-in attempts on Azure Virtual Desktop Client from disabled users

Question

Hi,

I am getting alerts related to "Sign-in attempts from disabled users", all these attempts are non-interactive sign-in attempts. Most of these attempts are from "Azure Virtual Desktop client", "Power BI Services" and some other apps as well.

Is this a known behaviour and if yes then is there any way that I can stop these Non-Interactive sign-in attempts.

We are getting a lot of noise because of this.

Thanks in advance.

Answer 1

@RSiddiqui Thank you for reaching out to us, regarding Non-interactive user sign-ins: these Sign-ins performed by a client on behalf of a user. These sign-ins don't require any interaction or authentication factor from the user. For example, authentication and authorization using refresh and access tokens that don't require a user to enter credentials.

As you mentioned above these are from disabled users, wanted to check is there any services/scheduled tasks running on behalf of these disabled users, from the logs we can get further device details from where these sign-ins are happening so that you can investigate further and isolate which application/services are being used by the disabled users.

Let me know if this information helps to isolate this issue else let me know we can connect offline review logs together and investigate further.