Recently in AzureAD logs I have started to see attempted logins to various users across my organisation. They all seem to have similar conditions such as:
1. Even though they are physically in Australia the logins occur from IP's in the UK e.g some IP's seen are 185.59.221.83 (Hounslow, Greater London, GB) and 109.70.144.22 (Needham Market, Suffolk, GB)
2. They are all showing in device info as "Azure AD registered"
3. Application identified as "Universal Store Native Client"
4. Resource identified as "Windows Store for Business"
Sometime they also have the following:
1. Same IP as the traffic for Application identified as "Universal Store Native Client" but
2. Application identified as "Microsoft Application Command Service"
3. Resource identified as "Microsoft Activity Feed Service"
Now I can understand if maybe these are some kind of background services attempting to access MS resources and are suing the Login for the Office tenancy but why are they coming from an IP in the UK when I know the person is in Australia at the time. Is Windows tunneling certain traffic? What is going on????
