AMC Prod failed login issue.

Question

Why are we seeing these new multiple failed AMC Prod logins from multiple different IPs, and what is this SMS sign-in authentication method? Where is this getting generated? And how do we resolve this issue in Microsoft Identity Protection?

Answer 1

The pattern shown is consistent with unusual sign-in activity rather than a normal user mistake. In Microsoft Entra, multiple failed authentications from different IP addresses can indicate password spray, brute force attempts, or a compromised password where the attacker cannot complete MFA.

The SMS sign-in method is a telecom-based MFA challenge. When it is triggered, Microsoft Entra generates the MFA request, selects an external telecom provider based on the country code, routes it through the configured SMS or voice channel, and the provider confirms receipt. After that point, delivery travels through external telecom networks.

Where it is getting generated:

1. The sign-in attempt starts in Microsoft Entra.
2. If the sign-in requires multifactor authentication, Microsoft Entra generates the SMS or voice MFA request.
3. The request is then sent to a third-party telecom provider and routed onward through carrier networks.

Why multiple IPs are appearing:

• Microsoft Entra guidance states that many failed sign-ins across multiple IP addresses can be an indicator of intrusion activity.
• A spike in MFA-required sign-ins can also indicate brute force attempts where the password may be correct but the attacker cannot satisfy MFA.
• VPN usage can create false positives, but repeated failures from many IPs should still be investigated.

How to investigate and resolve it in Microsoft Identity Protection / Entra:

1. In the sign-in logs, filter for:
   • Status = Failure
   • Authentication requirement = Multifactor authentication
   • The affected timeframe
2. Check whether the failed attempts are:
   • From the same user repeatedly
   • From the same or many IP addresses
3. Review the user’s sign-in activity for patterns such as:
   • Many failed authentications
   • Interrupted authentications
   • Large IP address changes
   • Smart lockout events
4. If the sign-in logs show the password was correct but strong authentication was required and not completed, treat that as a possible compromised-password scenario.
5. Use Microsoft Entra ID Protection to detect and mitigate identity-based risks automatically. The guidance recommends monitoring and alerting on these patterns and using ID Protection risk detections and policies to allow, deny, or require secure self-remediation based on risk.
6. If SMS delivery itself is failing or behaving unexpectedly, collect the Correlation ID and timestamp from the sign-in event. Microsoft can confirm whether the MFA request was generated, which provider was selected, whether the correct channel was used, and whether delivery was confirmed to the provider.

Important detail about SMS MFA:

• Microsoft can verify the request up to provider delivery confirmation.
• After that, visibility is limited because the message travels through external telecom carriers.
• If the SMS or call is dropped, blocked, or altered, the issue may be at the device, carrier, or regional telecom route level.

For remediation direction, the strongest path is to reduce reliance on telecom MFA where possible. Microsoft recommends moving to phishing-resistant methods such as passkeys, Windows Hello for Business, or certificate-based authentication.

---

• Microsoft Entra security operations for user accounts
• How to investigate sign-ins requiring Microsoft Entra multifactor authentication
• Troubleshoot MFA voice call and SMS problems
• Troubleshoot MFA voice call and SMS problems