drop microsoft account activity export · parse sign-in events · flag failed login mfa changes · csv/json export · runs locally
Sign-in · failed login · password · MFA · risky sign-in · app consent
heuristic screener · export schema varies by account/version · local parse only