Login lockout seems not to lock logins attempts. I have the standard setup: 5 fails / 300 seconds lockout. But in the log, I have a lot of fails from the same IP (like 10 every minute).
Also, the Audit Logging is not working and displays an error message:
"Whoops, Defender had trouble loading up your event log. You can try a quick refresh of this page or check back again later."