question

Dopod-1920 avatar image
0 Votes"
Dopod-1920 asked ·

AD-Azure Multiple login from From Foreign Country

Hello Member

Company implemented AD-azure for login O365. Now we found from the log has multiple login from Foreign Country Normally users base on japan. we found many country try to login.

My question is :

How can I know this login from originate AD-Azure ?

How can I block suspicious IP from foreign country try to login on AD-Azure ?

Thank and Best regard

azure-ad-user-management
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

amanpreetsingh-msft avatar image
0 Votes"
amanpreetsingh-msft answered ·

Hi @Dopod-1920 · Thank you for reaching out.

You can download Azure IP Ranges using the link below:

You can then compare the IP address in the sign-in event with the Azure IP Ranges to identify if it is a sign in originated from Azure.

If you find any suspicious IP addresses in the sign in event, you can block that via Conditional Access Policy.

Another option to block suspicious sign-ins is, by using Azure AD Identity Protection.

Note: Conditional Access Policy requries at least Azure AD Premium P1 license and Azure AD Identity Protection requires at least Azure Ad Premium P2. If you have P2 license, you can use both features. You can also integrate Identity protection with CA Policies as well to apply risk based conditions.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

·
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.