Noticed that the office365 plugin has been redeeming unusual amount of azure ad logs.
Example: user X had 5 logins during the day in app Y but in the logs received by the SIEM there are only 3 events.
Not sure if anyone had similar issues, so I want to test with polling numbers first. Any recommended values?
