Is there a way of access an audit (in SharePoint Online) that would show me all of the log-in attempts, (as well as what caused a login failure)?
The reason being that we have an external user who after an invite is able to access the shared location but then gets a “you don’t have access” error when trying to access at a later time. Seems to work only once. This person users a organization logon, not a personal Microsoft account.
It could be due to an expired password or the object had become corrupted in some way. You can reset the password then update the object’s attributes in order to activate the account again.
Please refer to below article for more information – http://www.mattwharton.co.uk/2015/10/sharepoint-online-login-failure-issue-type-user-not-in-directory.html
Moreover, if user are connected to active directory, please have a look at below article – https://www.lepide.com/blog/audit-successful-logon-logoff-and-failed-logons-in-activedirectory/
