Hi there. We have started getting some troubles with hackers getting passwords of our users (probably trick them through fake websites). We are currently starting to roll out Multifactor, but this takes time. In the meantime we are trusting to look at Azure RiskySignIns ( https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/RiskySignIns ) however we have discovered that this does not pick up nearly enough. When we go to audit log search ( https://protection.office.com/#/unifiedauditlog ) of a user, then we often find that his IP has been successfully logged in from many countries.
Is RiskySignIns broken, or do Azure not log users logging in through Office365? Could somebody explain me the differences between these services?