Forum Discussion
Why are Microsoft Data Centres logging in to my Office 365 accounts? Activity Alerts - BAV2ROPC
Hello, I have an activity alert set up to email me whenever a log in is detected from one of my 12 office 365 email users. These emails contain the username logging in and the IP address the log in o...
We have seen the exact same behavior a couple of times now, both were for user accounts that were removed several years ago. The latest was for a user that left in 2010. The IP's are showing as MS Data Centers in South Korea and Dublin.
i was alerted by my email security company that a user had successfully logged in from The Ukraine. In Azure AD the user agent is this: User agent BAV2ROPC
So I Googled it and here we are. I see it's being called an old version of an office app login, but also pops when a user is using a VPN to stream and then logs into office365 with the VPN still on. So I haven't gotten any closer to solving this and I hope someone has some more info. I didn't hear a peep from Sentinel One or Darktrace on this
