Audit logs with 255.255.255.255 Ip Address

Question

Audit logs with 255.255.255.255 Ip Address

T_B_ 16

I have some entries in the AuditLogs of my tenant where the InitiatedBy.user.ipAddress field has the address "255.255.255.255".
Mainly logs about "security info" update/delete.
What does this mean?
How can an Azure user has this address?

JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator

2022-12-09T23:25:04.987+00:00

@T_B_
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.
NicholasHandelsmann-7401 0 Reputation points

2024-11-13T12:27:19.51+00:00

Hello everyone.

I have a similar problem.

The action [‘User registered Outlook mobile with Code’] (in connection with a change of the authentication method) is always associated with the InitiatingIpAddress 255.255.255.255.

What is the reason for this? And how can I find out from where this action was performed by the user?

1 answer

Your answer

JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator

2022-12-09T23:25:04.987+00:00

@T_B_
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.
NicholasHandelsmann-7401 0 Reputation points

2024-11-13T12:27:19.51+00:00

Hello everyone.

I have a similar problem.

The action [‘User registered Outlook mobile with Code’] (in connection with a change of the authentication method) is always associated with the InitiatingIpAddress 255.255.255.255.

What is the reason for this? And how can I find out from where this action was performed by the user?

Answer 1

@T_B_ Thank you for reaching out to us. As I understand you would like to investigate about the audit logs having this information 255.255.255.255.

Did a quick repro in my demo tenant, on deleting the authenticator app information from a user within Azure AD portal trigger's below information within the audit logs.
Activity Type - Admin deleted security info
Status reason - Admin deleted Microsoft Authenticator Authentication Method for user
IP address - 255.255.255.255

Just wanted to check are you trying to delete authenticator app information for any user from Azure AD portal? were you able to delete it successfully? Thats when you see this ip address being logged in the Audit logs.

Let me know if you have any further questions, feel free to post back.

Share via

Audit logs with 255.255.255.255 Ip Address

1 answer

Your answer