Simple Question about CAS and CA Policies

[Jim_Hill]

Several of my Exchange online accounts are subject to frequent login attempts by various means.  Recently I have a bunch of attempts using IMAP from foreign countries.  IMAP is disabled for that account, but SMTP is allowed (for the time being). We we have one CA policy which applies, ,Blocks login from foreign country. When I test using the What If tool these foreign logins using IMAP are indeed blocked. But yet the user account is getting locked and the logs show multiple breakin attempts.  What is going on?  Shouldn't the CA policy and IMAP restriction prevent the login attempt from the first place, or will the log continue to grow with failed logins from IMAP while locking the account? 

[#2 · Accepted solution]

Best configure an authentication policy in Exchange, it stops those attempts before they even hit AAD: https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/disable-basic-authen...

[#3]

@Vasil Michev Thanks very much. Because of your comment I looked up the method to create and apply a new authentication policy. I made one that blocked all basic authentication, then modified it to allow authenticated SMTP. Then I applied it on a per user basis.  This seemed to work well and like you said it should stop it before it gets into the Azure AD.  Thanks so much.