O365 Multiple OS Vendors Authenticating From User

This analytic identifies when a single user account attempts to authenticate to Azure/EntraID/Office 365 from multiple distinct operating systems within a short timeframe. This behavior can indicate an attacker's attempt to enumerate various logon capabilities, potentially to discover weaknesses in an organization's MFA or conditional access configurations. Tools like "MFASweep" are known to trigger this detection.