The log is found in the official Elastic Repository at: https://github.com/elastic/beats/blob/main/x-pack/filebeat/module/azure/signinlogs/test/test-non-interactive-user-signin.log-expected.json

For the Azure Signin Module, the following field should have the periods in "Legacy TLS (TLS 1.0, 1.1, 3DES)" replaced with an underscore or another value. When the value is unflattened, Filebeat views the periods as subfields, which is not the intent.
"azure.signinlogs.properties.authentication_processing_details.Legacy TLS (TLS 1.0, 1.1, 3DES)": "False",

It should be something like:
"azure.signinlogs.properties.authentication_processing_details.Legacy TLS (TLS 1_0, 1_1, 3DES)": "False",