O365 Excessive SSO Logon Errors

The analytic detects accounts experiencing a high number of Single Sign-On (SSO) logon errors within Office 365. It specifically looks for `UserLoginFailed` operations with `LogonError` containing "Sso" in the `o365_management_activity` data. A count of 5 or more such errors from the same source, vendor account, vendor product, destination, signature, and user agent within a given timeframe is considered anomalous. This activity can indicate brute-force attempts against SSO, credential stuffing, or attempts to reuse hijacked SSO tokens, potentially leading to unauthorized account access, data breaches, or further compromise.