409 votesCloudGuy commented
As an o365/azure administrator my job to know of a compromised account immediately or about a suspicious login. We upgraded to a paid version (P2) in hopes of finding about this type of issues immediately but it has not been very successful of delivering the promise. We would like to be able to get the alert immediately when sign-ins are happening from regions we have no business in and or any suspicious activity for that matter. So I absolutely agree with the others on this board that the alerting and reporting needs to be improved drastically to justify the price per user.