By monitoring activities in the logs, we can discover anomalous and suspicious user behavior and assess the potential risk of certain activities, such as the geographic location of the user when they access the system: if it is not their usual location (such as Australia), then we can decide whether they should be blocked or at least prompted for an alternative authentication request (MFA). Microsoft offers this functionality as part of Office 365 E5 licenses (Advanced Security Manager) and the Enterprise Mobility & Security E5 suite (Microsoft Cloud App Security).