Entra ID - user sign-ins (non-interactive) - failed connection attempts

Hi deepdef,

thanks for the update.

if MFA is not applicable due to legacy authentication, and conditional access rules don't  apply to non-interactive authentication, it is crucial to explore other options.

Here are some additional suggestions:

1. Investigate Legacy Authentication Settings:
Ensure that legacy authentication is completely disabled or restricted to the necessary scenarios. If there are any misconfigurations, it could lead to unexpected authentication attempts.

2. Check for Service Account Issues:
Confirm that service accounts associated with Skype for Business Online are properly configured and have not been compromised.

3. Review Application Permissions:
Examine the permissions granted to the Skype for Business Online application. Make sure that only necessary permissions are assigned, reducing the potential attack surface.

4. Azure AD Sign-in Logs:
Review Azure AD sign-in logs for any additional details or patterns related to these non-interactive sign-ins. Look for commonalities in terms of time, users, or other attributes.

5. Network and Firewall Logs:
Explore network and firewall logs to see if there's any unusual traffic associated with these authentication attempts. It could help identify potential sources or patterns.

6. Microsoft Security Updates:
Stay informed about Microsoft security updates and patches. Applying the latest updates can help address any known vulnerabilities.

If, after thorough investigation, the issue persists, reaching out to Microsoft Support with detailed information about your configuration and the problem you're facing would be a good next step.