Locked account due to many attempts from malicious IP

Treat this as a password spray incident, not a country blocking problem. Verify Microsoft Entra Smart Lockout is enabled, block legacy authentication, and use Identity Protection risk based Conditional Access to require MFA or block medium and high risk sign ins; Microsoft 365 E5 Security includes the required Identity Protection capability. Review the affected accounts for successful sign ins, reset passwords and revoke sessions where compromise is suspected, then monitor and alert on password spray detections. Deploy Conditional Access policies in report only mode first and exclude emergency access accounts to avoid tenant lockout.