BING non-interactive sign-in attempts

Question

Hi all I got a lot of warnings in my tenant that user is trying to authenticate from outside US because we have outside of US access is controlled in our organization

when I check the log, I found this: Non-interactive sign-in

App = BING

IP = is showing different country every time but when I check the IPs against whois-IP they are all from US

my question here is: is this BING search from EDGE trying to login using the user credentials? or what?

thanks

Answer 1

Hi @Saif Almodares ,

This is a known behavior with non-interactive sign-in logs with unexpected IP addresses from Bing. Bing sends unknown successful/unsuccessful sign-in requests from unknown IP addresses. The Bing team fixed a bug that sends unsuccessful sign-in requests to Entra ID, but they still send valid (necessary) sign-in requests from the Data Centers where the Bing service is running. 

The resources would try to so a silent authentication on behalf of users and depending on where those resource are Hosted (Microsoft Data Centers), it will list the IP from there. For instance, Bing would be listed as the App for different sources and the location of them is at different Microsoft Data centers. You can confirm that the IPs are Microsoft IPs by checking here: https://whatismyipaddress.com/ )

Let me know if this helps and if you have further questions.

If the information helped you, please Accept the answer. This will help us and improve searchability for others in the community who may be researching