Defender XDR allowing malicious emails with failed authentication

Question

We are experiencing issues with Defender XDR allowing malicious emails with authentication failed miserably while rightfully quarantining/dropping other emails from the same threat vector. We have raised our anti-phishing level threshold to the maximum level 4 Most Aggressive however issue persists. Microsoft's detection technologies such as Spoof intra-org, Phishing, and others are blocking 98% of unwanted emails and we need to understand how to fix this. Any suggestions/help will be greatly appreciated. Thank you in advance.