KQL Log Fail EXO

IdentityLogonEvents
| where Timestamp > ago(3d)
| where ActionType == "LogonFailed" and LogonType == "OAuth2:Token" and Application == "Microsoft Exchange Online"
| summarize count(), dcount(IPAddress) by AccountObjectId, AccountDisplayName, bin(Timestamp, 1h)