I've noted recently a spike in impossible travel alerts in my MCAS. When looking at the activity all the activity appears in my home country (AU) but dotted throughout is activity from other MS DC IP's in other countries causing an impossible travel alert.
When I look at the type of activity that is triggering this it appears to be audit activity not user activity. nearly all the activities show as "Run command: task MailItemsAccessed;"
Googling this it looks like this is a legit activity to generate an audit log of activity on a mail file. My problem is they are being run across random and multiple data centers. How can I ensure these are not run across O\S data centers so they stop generating false positive alerts? Do I need to maybe whitelist IP's?
Here is a redacted sample of one of the activities:
{
"OrganizationId": "REDACTED",
"CreationTime": "2020-01-19T00:00:00.0000000Z",
"RecordType": 50,
"Operation": "MailItemsAccessed",
"Workload": "Exchange",
"UserType": 0,
"UserKey": "REDACTED",
"Version": 1,
"OriginatingServer": "REDACTED (XXX.XXX.XXX.XXX)\r\n",
"InternalLogonType": 0,
"UserId": "REDACTED@REDACTED.com.au",
"OrganizationName": "REDACTED.onmicrosoft.com",
"ClientInfoString": "Client=MSExchangeRPC",
"ClientIPAddress": "[XXX.XXX.XXX.XXX]:17147",
"MailboxOwnerSid": "REDACTED",
"MailboxOwnerUPN": "REDACTED@REDACTED.com.au",
"Id": "REDACTED",
"ExternalAccess": false,
"ResultStatus": "Succeeded",
"LogonUserSid": "REDACTED",
"MailboxGuid": "REDACTED",
"LogonType": 0,
"SessionId": "REDACTED",
"OperationProperties": [
{
"Name": "MailAccessType",
"Value": "Bind"
},
{
"Name": "IsThrottled",
"Value": "False"
}
],
"OperationCount": 1,
"Folders": [
{
"Id": "REDACTED",
"Path": "\\Deleted Items",
"FolderItems": [
{
"InternetMessageId": "<REDACTED.ausprd01.prod.outlook.com>"
}
]
}
]
}
