Log Analytics Audit - Failed logins

Needing to know if users fail their logins, this KQL query in Log Analytics, will tell you just that.

AzureDiagnostics
| where Category == "SQLSecurityAuditEvents"
| where action_name_s == "DATABASE AUTHENTICATION FAILED"
| summarize FailedAttempts = count() by User = server_principal_name_s, ClientIP = client_ip_s, Database = database_name_s
| order by FailedAttempts desc