Suspicious logins to Azure CLI with Python request User Agent

Question

Hi!

We regulary have this kind of logins in our environment (Large, mostly Students). Both, successful and failed logins:

Details from Defender for Cloud:

  "ApplicationId": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
  "ApplicationName": "Microsoft Azure CLI",
  "Call": "OAuth2:Token",
  "Client": "[x-client-sku, MSAL.Python];[x-client-ver, 1.20.0];[x-client-cpu, x86];[x-client-os, win32]",
  "CorrelationId": "XXX",
  "DeviceInfo": ";;Python Requests 2.26;",

…
}

Are there any legitimate use cases for a third party (not the user himself) to produce such logs?

I'm asking, because the source IP addresses are registered to Microsoft most of the time:

{
  "ip": "20.170.20.146",
  "city": "Frankfurt am Main",
  "region": "Hesse",
  "country": "DE",
  "loc": "50.1025,8.6299",
  "org": "AS8075 Microsoft Corporation",
  "postal": "60326",
  "timezone": "Europe/Berlin",
  "readme": "https://ipinfo.io/missingauth"
}

Thanks for your input! Christian

Answer 1

Nowadays we see this user agent with new version. It is seen that is regarding ARM. I think the account tries to authenticate itself and uses this user agent. Because we see same user agent on different customers.

Answer 2

Hi Christian,

Did you ever find a good reason for this type of activity? We are seeing similar, also on some of our students. At first I suspected it was compromised accounts, but now I'm not so sure, considering the amount we suddenly get. Plus the fact IP's are indeed from Microsoft, also we are suddenly seeing failure logins on accounts, where they have NOT changed their password.

We do plan on activating MFA for our students, but it's still some months away.

Answer 3

Successful logins may be a signal of account being compromised. Be sure to activate MFA for those users, as well as change the passwords for the successful logins from suspicious IPs.