AD-Azure Multiple login from From Foreign Country

Question

Hello Member

Company implemented AD-azure for login O365. Now we found from the log has multiple login from Foreign Country Normally users base on japan. we found many country try to login.

My question is :

How can I know this login from originate AD-Azure ?

How can I block suspicious IP from foreign country try to login on AD-Azure ?

Thank and Best regard

Answer 1

Hi @Dopod · Thank you for reaching out.

You can download Azure IP Ranges using the link below:

• https://www.microsoft.com/en-us/download/details.aspx?id=56519

You can then compare the IP address in the sign-in event with the Azure IP Ranges to identify if it is a sign in originated from Azure.

If you find any suspicious IP addresses in the sign in event, you can block that via Conditional Access Policy.

• Conditional Access: Block access by location

Another option to block suspicious sign-ins is, by using Azure AD Identity Protection.

• Azure AD Identity Protection: Configure and enable risk policies

Note: Conditional Access Policy requries at least Azure AD Premium P1 license and Azure AD Identity Protection requires at least Azure Ad Premium P2. If you have P2 license, you can use both features. You can also integrate Identity protection with CA Policies as well to apply risk based conditions.

• Conditional Access: Sign-in risk-based Conditional Access

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.