| extend timestamp = StartTime, AccountCustomEntity = UserPrincipalName | sort by AttemptCount 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 第三个示例是查看MFA身份验证尝试失败的用户。 SigninLogs | where TimeGenerated >= ago(31d) | where ResultType == "50074" 1. 2. 3. 第四个...