Forum Discussion

casualbob's avatar
casualbob
Copper Contributor
Jan 30, 2020

Why are Microsoft Data Centres logging in to my Office 365 accounts? Activity Alerts - BAV2ROPC

Hello, I have an activity alert set up to email me whenever a log in is detected from one of my 12 office 365 email users. These emails contain the username logging in and the IP address the log in o...
Alerts
office 365
security
Aquilius's avatar
Aquilius
Copper Contributor
Oct 21, 2020

casualbob 11K views and yet still no official address of what is going on here

  • Flobber's avatar
    Flobber
    Copper Contributor
    Oct 30, 2020

    And the beat goes on.

    • Alicia_Shelley's avatar
      Alicia_Shelley
      Copper Contributor
      Nov 12, 2020
      20.190.128.80 Microsoft San Antonio, TX as well.
      • BdCvC's avatar
        BdCvC
        Copper Contributor
        Nov 12, 2020

        Alicia_Shelley 

        Interesting new development, UnifiedAuditLogs in Europe have failed to update UserLoggedin records since around 25/11/2020, logged a case with MS, have seen AZ auditlogs re-feed old data to unifiedauditlogs but username is not the email address but the SID, so this looks like they have a problem and a bug. I added a P1 lic to one of my 12 Tenants and checking Get-AzureADAuditSignInLogs in stead, will let you know if this is more accurate regarding the incorrectly recorded MS sites.

Resources