There is this alert that can be raised if you use ADFS and Defender for identity, for more details read… READ MORE
When everything else fails, use SysInternals process monitor tool and you will be surprised
~ Me
Exchange/Sharepoint/SfB/Teams/TFS/AzureDevOps/PS and a little Dev Stuff from a Computer Science Engineer/Microsoft Senior Consultant.