In the Azure AD Identity Protection dashboard (portal.azure.com | search for Azure AD Identity Protection), you'll notice some reports on the left, including Risky users in which Azure has flagged suspicious activity for your review. At a glance, you can see which have been remediated (or not) and what the level of risk is:
Risky sign-ins would list any sign-in activity deemed risky and give you all of the identifying information for the machine, sign-in location, risk type, and so on.
Risk detections ...
