Office 365 Audit Logs: Multiple failed login attempts from a Microsoft IP address

Hi,

I have enabled and am reviewing audit logs for our organization, I am seeing multiple failed login attempts, all from Microsoft owned IP addresses. Here's a sample JSON from the downloaded csv:

{
   "CreationTime":"2017-06-07T06:54:43",
   "Id":"53e83604-6caa-4c83-a49c-5bede62f28c1",
   "Operation":"PasswordLogonInitialAuthUsingPassword",
   "OrganizationId":"<redacted>",
   "RecordType":9,
   "ResultStatus":"failed",
   "UserKey":"<redacted>",
   "UserType":0,
   "Version":1,
   "Workload":"AzureActiveDirectory",
   "ClientIP":"40.97.160.21",
   "ObjectId":"<redacted>",
   "UserId":"<redacted>",
   "AzureActiveDirectoryEventType":0,
   "ExtendedProperties":[
      {
         "Name":"LoginError",
         "Value":"-2147217390;PP_E_BAD_PASSWORD;The entered and stored passwords do not match."
      }
   ],
   "Client":"Exchange",
   "LoginStatus":-2147217390,
   "UserDomain":"<redacted>"
}

Here's the whoisip lookup for that IP:

Source: whois.arin.net
IP Address: 40.97.160.21
Name: MSFT
Handle: NET-40-74-0-0-1
Registration Date: 23/02/15
Range: 40.74.0.0-40.125.127.255
Org: Microsoft Corporation
Org Handle: MSFT
Address: One Microsoft Way
City: Redmond
State/Province: WA
Postal Code: 98052
Country: UNITED STATES

Other Microsoft IPs in the logs include: 40.97.128.197, 40.97.128.37, 40.97.130.181, etc. In total 40 unique IP addresses from the Microsoft owned subnet 40.97.*.* in the past week


Any suggestions about what is trying to login from these IP address? Perhaps a tool integration that's broken?


Answer
Answer
Hi Mk-rct,

It’s expected behavior that Microsoft IP address is logged in the Audit log.

Here is the reason:

When a user is using a Microsoft Service (such as Word Online, Excel Online) to view documents from SharePoint, it is possible that they’ll make a direct request for the file from SharePoint, and it is also possible that the service in the middle (Word Online, Excel Online, ect.) makes a request to SharePoint on the user’s behalf.

The related team has been aware there’s room for improvement. They’re currently collaborating between teams. However, we hope you understand it’s a long term process in the future, and it’s not expected to see change in short term.

Regards,
Jiaxing

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

 
 

Question Info


Last updated October 30, 2020 Views 2,647 Applies to: