Hi there!
In our company's sentinel I detected some anormal activity.
In the past 3-4 weeks several users tried to login to the Azure Portal from IP adresses, which belongs to a Microsoft Datacenter. Each User was used three-four times max.
The IP adresses where never the same (except of one IP adress which was used twice).
The Location was in the USA and Canada.
The Login was blocked with the Result Description was either "Invalid username or password or invalid on-premise username or password" or "Sign-in was blocked because it came from an IP address with malicious activity"
Has anybody detected similar behaviour, maybe in the past?
I hope I described the behaviour detailed enough.
