Very high number of successful logins

Question

I am receiving more than 20k sign in events successful and failures or interupted in one week. This does not happen for every user but there are a handful that are. They seem to reference Augmentation Loop. I cannot figure out why there are so many logons.

Answer 1

Hello @Jack Lucivero,

Thank you for posting your query on Microsoft Q&A.

From your description, it seems that you are seeing around 20k sign-in events—both successful and failed—in one week.

Here are some steps to help diagnose the issue:

1. Identify Affected Users: Determine which specific users are experiencing the high volume of sign-in events to focus your investigation.
2. Examine User Patterns: Check if the affected users share common characteristics, such as specific roles, permissions, or devices.
3. Review Microsoft Entra Sign-in Logs: Analyze the logs to see if the issue is isolated to iOS or Android devices, or a particular application.
4. Check Conditional Access Policies: Look for any recent changes to conditional access policies in your tenant.
5. Compare Users: Select a user who is not experiencing this issue and compare their settings with those of a user who is. Verify if they are subject to the same conditional access policies.
6. Analyze Log Types: Confirm whether these logs are from interactive or non-interactive sign-ins. Examine the differences between successful and failed sign-ins to understand the reasons behind the failures.

I hope these steps help you diagnose the issue. Please feel free to reach out if you have any further questions.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know. Thanks,
Raja Pothuraju.

Answer 2

Augmentation loop is part of Editor for Outlook/Office on mobiles, you can ignore such entries.