MCAS Log on Event

JeffR_CNY Hi, the external user may have authorized a third-party application to interact with Microsoft 365 services. This application could update tokens periodically, without requiring direct user intervention, causing access events.

Have you received only 1 alert and had no other activity? It is possible that an automated service is using the external user's account to authenticate and access resources.

As verifications I would do:
-Check OAuth Permissions; check the external user's OAuth permissions in your environment. Look for any third-party applications that have permission to access the organization's data on behalf of the user.
-Check External Apps; if the external user has interacted with a third-party app, audit the app's activities and permissions.

As operations:
-Token revocation; if you suspect that the account or token is compromised, consider revoking the OAuth token and request a new authentication for the user.

IP Address Monitoring; continue to monitor the IP in question to see if it generates any further alerts or suspicious activity.