Users with on-premise mailboxes connect from Azure IP addreses

Question

Hello.

I am using hybrid Exchange 2019. Most of the users have local mailboxes. I have done some IIS logs checks and I found lot of connections from IP addresses that seem to come from Azure and they are authenticated with username that has on-premise mailbox. I thought it could be caused by MS Teams, but some of those users do not even have any Office 365 license at all and it connects to Active Sync. Why is that? An example:

2020-12-04 00:01:40 10.96.4.51 POST /Microsoft-Server-ActiveSync/default.eas Cmd=Ping&User=austin%5Capsk.presov&DeviceId=efc5875018c148f48d8de89d46d34a5f&DeviceType=Outlook&CorrelationID=<empty>;&cafeReqId=95b338df-f3d3-4458-a82b-f834c94a73b9; 443 austin\apsk.presov 52.97.175.181 Outlook-iOS-Android/1.0 - 200 0 0 180110

Thank you

Honza

Answer 1

Hi @Honza ,
that is expected with Outlook Mobile
It connects to 365/Azure as part of it architecture

https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/outlook-for-ios-and-android/outlook-for-ios-and-android-faq

https://learn.microsoft.com/en-us/answers/questions/180033/event-id-4624-amp-4648-getting-ip-address-from-mic.html

Answer 2

Thank you AndyDavid. Is there a way how to change this behavior? I know that I can connect Exchange server with Outlook for iOS or Android if I do not have Office 365. But we have hybrid Exchange for a short time and we did not change the settings for mobile users. They were set to connect Exchange server directly, but after Office 365 got into the picture, they changed their behavior. I have a script that monitors logons from distant locations in short time for same user. This Outlook behavior makes a mess in logs. :-(