To get Windows failed logon events (Event ID 4625) into your Microsoft Sentinel workspace, ensure you've configured a Azure Monitor Agent (AMA) data collection rule or a Windows Security Events data connector to send security logs to the SecurityEvent table. Verify that the Azure Arc-enabled server or Azure VM is sending data to the correct Log Analytics workspace by checking its configuration and validating the data in the SecurityEvent table using the query SecurityEvent | where EventID == 4625.
Reference:
https://learn.microsoft.com/en-us/azure/azure-monitor/reference/queries/securityevent