Need some advice on how this could have happened and other remediation steps. We have a customer using Microsoft 365 Business Premium. All users have MFA enabled and the default is OTP using the Microsoft Authenticator. The user complained they were not receiving any emails sent to them from internal users. They were receiving external emails. After review we identified an Outlook server rule was created for this user to move all emails received from others in their domain to a newly created Outlook folder named RSS Feeds. We deleted the RSS Feeds folder, the Outlook rule, and moved the messages back to the inbox. We signed out the user from all devices and reset the password.
Reviewing Azure sign ins over the past week we found entries showing what appears to be a successful login from Iowa State University. The customer is in a different state and they do not know of anyone in Iowa. It appears the first attempt was interrupted resulting in MFA required in Azure AD. Yet a minute later they were able to get into Exchange online successfully with authentication method - previously satisficed. See attachment for 4 screenshots. Showing details of the signs and the new-inbox rule creation from the ip address in Iowa.
How is this possible? What else should we review? Should we report this to Microsoft? Is there a charge to report something like this? Please let me know if you need any additional details or if I should report or post this elsewhere. Thank you.
