Investigate shows unsuccessful login and no successful login when a user logs into Microsoft with MFA

Products

• CASB Securlet SAAS

Issue/Introduction

When logging in to Microsoft, such as OneDrive or Sharepoint, if the login uses MFA, the user logs in successfully but there is no successful login event showing in Investigate.

An unsuccessful login is showing in Investigate

Cause

This was due to an API call being made to MS.

Resolution

This has been fixed with CASB version 3.177 to show a successful login.

The unsuccessful login will also show in Investigate still. In the Microsoft portal audit logs, a login for a user using MFA also shows an unsuccessful login as well as the successful login. So CASB Investigate is reflecting what Microsoft Audit it showing.