Managed ITDR

Can monitoring for the "device registration trick" be added to ITDR for when a user falls for a phishing scam and enters their M365 credentials. Then in Entra, the user has multiple new Devices added to their account in a very short space of time.

Allow the customer to opt in to brute force notification alerting. This could be from the Smart Lockout Alert feature. Once that has been triggered notify, alert with through email or integration, and allow the notification level to be set, and allow automation rules to run against that user account or group or app.