Query about AMC PROD

Question

We have observed multiple sign-in attempts originating from different locations and IP addresses, with the Application Name identified as "AMC PROD." Following these sign-in attempts, the affected user accounts are being flagged as High Risk.

Could you please help us understand:

Why these sign-in attempts are occurring from multiple locations and IP addresses under the "AMC PROD" application?

What factors are causing the user accounts to be classified as High Risk after these attempts?

How can we verify whether these sign-in activities are legitimate or potentially malicious?

What are the recommended remediation steps and preventive measures to mitigate this issue and prevent users from being placed in a High Risk state?

Any guidance on root cause analysis and resolution would be greatly appreciated.

Answer 1

An important piece of information was missing from the previous answer.

The organisation likely has SMS sign-in enabled, allowing anyone with a mobile number to initiate sign-in attempts. We have been receiving numerous alerts, particularly from regions where users' mobile numbers have likely been leaked in a database, and threat actors are attempting to log in from different regions.

Solution: SMS sign-in should be turned off or disabled in Entra ID under the authentication method. If it is necessary for business reasons, it should only be enabled for specific targeted users.

Answer 2

The behavior described matches Microsoft Entra ID Protection sign-in risk detections and unusual sign-in patterns. The "AMC PROD" application is simply the app where the sign-ins are occurring; the high risk classification is driven by the sign-in characteristics, not the app name itself.

1. Why sign-ins appear from multiple locations and IPs under "AMC PROD"

Multiple locations and IP addresses for the same user and application typically indicate:

• Normal distributed access (for example, users traveling or using different networks), or
• Use of VPNs / anonymous proxies, or
• Credential misuse by an attacker from different networks.

Microsoft Entra ID Protection and Defender for Cloud Apps specifically look for:

• Activity from anonymous IP address (anonymous VPN, Tor, etc.)
• IP changes and sign-ins from many different IPs
• Atypical travel or impossible travel between sign-ins

When these patterns are observed for the same user and application (here, "AMC PROD"), the sign-ins are flagged as risky.

2. Why user accounts are classified as High Risk

User risk is raised when one or more high-confidence detections fire. Relevant detections include:

• Anonymous IP address: Sign-ins from anonymous VPN/Tor or similar services.
• Atypical travel / impossible travel: Two sign-ins from geographically distant locations in less time than it would take to travel, indicating possible credential theft.
• Anomalous token (sign-in): Tokens used from unfamiliar locations, unusual lifetimes, or unexpected apps/IPs, suggesting token replay.
• Suspicious MFA authentication approval: MFA approvals from devices/locations that don’t match the sign-in request, indicating possible social engineering.
• Password spray / leaked credentials: Confirmed credential exposure or successful password spray.

When these detections occur, Microsoft Entra ID Protection can classify the sign-ins and/or users as High risk, especially when multiple detections correlate (for example, anonymous IP + atypical travel + anomalous token).

3. How to verify if the sign-ins are legitimate or malicious

Use the investigation framework and sign-in logs:

1. Review sign-in logs for the affected users
   • Check for:
     • Application: confirm "AMC PROD" is legitimately used by the user.
     • Device: is it a registered/compliant device the user normally uses?
     • Location: is the user known to operate from these countries/regions?
     • IP address: does it match known corporate egress IPs or sanctioned VPN ranges?
     • User agent string: is the browser/client typical for the user?
2. Correlate with risk detections
   • Use ID Protection risk reports to see which detection types fired (anonymous IP, atypical travel, anomalous token, password spray, leaked credentials, etc.).
3. Check for patterns of unusual sign-ins
   • Many failed authentications from multiple IPs.
   • Impossible or atypical travel.
   • Sign-ins from locations where the organization has no presence.
4. Validate VPN / proxy usage
   • If the IPs belong to sanctioned VPNs, add them as named locations and confirm sign-ins as safe.
   • If they are anonymous or malicious IPs, treat them as indicators of compromise.
5. Use other security tools (if available)
   • Microsoft Sentinel and Microsoft Defender XDR to look for related alerts and incidents involving the same users, IPs, or devices.

If the characteristics (location, IP, device, app) are expected and there are no other indicators of compromise, the sign-ins can be marked as safe. Otherwise, treat them as compromised.

4. Recommended remediation and preventive measures

Follow the ID Protection risk remediation framework:

1. Contain and remediate current risk
   • For sign-ins confirmed as compromised:
     • Mark sign-in as compromised.
     • Invoke a password reset (or self-service password reset via risk-based Conditional Access).
     • Block the user if an attacker can reset the password or perform MFA.
     • Revoke all tokens (especially for anomalous token or malicious IP detections).
   • For password spray or leaked credentials:
     • Reset password and revoke tokens.
     • Ensure smart lockout is configured to reduce brute-force and spray impact.
2. Use risk-based Conditional Access policies
   • Require password reset or MFA for high-risk sign-ins.
   • Block access for sign-ins from anonymous or malicious IP addresses.
   • Enable self-remediation flows so users can resolve risk (password reset, MFA re-registration) when prompted.
3. Baseline and tune “normal” sign-in behavior
   • Define normal parameters: typical locations, known egress IPs, expected number of failed sign-ins, MFA attempts, and whether legacy auth is allowed.
   • Monitor for:
     • Unusual locations and impossible travel.
     • Large volumes of IP changes and failed authentications.
     • Interrupted authentications and smart lockout events.
4. Harden accounts and environment
   • Enforce MFA for all users, prioritizing privileged accounts.
   • Disable legacy authentication where possible.
   • Monitor privileged accounts more aggressively for unusual sign-ins.
   • Use Insider Risk Management (if available) to detect large data downloads or other risky behavior following suspicious sign-ins.
5. Ongoing monitoring and impact analysis
   • Use the ID Protection dashboard and risk reports to track high-risk users and sign-ins.
   • Use the Impact analysis workbook to understand where risk is evident and which policies should be enabled.
   • Regularly review sign-in logs for similar activity (same IPs, geographies, applications) to identify broader compromise.

By combining sign-in log analysis, ID Protection risk detections, Conditional Access policies, and token/password remediation, organizations can determine whether "AMC PROD" sign-ins are legitimate, contain any compromise, and prevent users from remaining in a High Risk state.

---

References:

• What are risk detections?
• Microsoft Entra security operations for user accounts
• How to investigate risk