If I unlock the account, it will happen again the instant he attempts to connect to a drive. This only happens over VPN; on days he is working in office, he is able to work without issue.

Microsoft is updating Microsoft Defender for Identity to allow security operations (SecOps) teams to block attacks by locking a compromised user's Active Directory account. Microsoft Defender for ...