Microsoft 365 Security is smart. It’s constantly learning. New capabilities are being added. The user experience is evolving. These facts make creating a perfectly consistent CIE experience challenging. Alerts created to support the story represented in the click-steps may not consistently show up.
One of the most common security support requests from our customers is for assistance with remediating an account compromise. The most common scenario is that a member of their organization became the victim of a phishing scam and the attacker obtained the password for their account.