Forum Discussion
activity SearchQueryPerformed IP location is from another country
Hi All, lately I am watching the audit log to see ifthere are many unauthorised login trials from IP addresses which are geographically located in suspect locations, that is other than location f...
Anyone have an answer to this? I see10's of "SearchQueryPerformed" records in our activity log for each of our users per day. All the IP's resolve back to MS.
The issue I have is the requests come from all over the place, US, Canada, France, Ireland, etc. but all of our users are in the US and I can't find a good reason to explain what this is and why it's not an issue or why it is an issue.
Orion711 I'm seeing the same SearchQueryPerformed activity. All IP's come back to MS. In this particular tenant space it's only for one user, which I can't explain. Because I initially thought it was a bad actor I did a password reset and MFA reset on all devices. Queries continue.