Authentication logs:

Domain controller logs (Windows Event IDs 4624, 4625, 4648, 4768, 4769) - VPN connection logs - Multi-factor authentication logs - Service authentication logs