question

SPSteve-6194 avatar image
0 Votes"
SPSteve-6194 asked SPSteve-6194 edited

SPO Network Location Access Control - How to Look Up Blocked Attempts

We're having an issue with an outside vendor getting blocked when attempting to open SharePoint docs.  We use Network Location Access Control (IP whitelisting) but cannot determine what new IPs to allow.

We've tried looking in the audit logs in Security Center but that only shows failed (or successful) authentication attempts.  Is there a log that shows the IPs of requests have been blocked when trying to access SharePoint?

office-sharepoint-online
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

CaseyYangMSFT-4714 avatar image
0 Votes"
CaseyYangMSFT-4714 answered SPSteve-6194 edited

Hi anonymous user

You can use PowerShell to export login history report looks similar below screenshot. The following link will help you for more details.
98430-1.png

For Reference:
https://o365reports.com/2019/12/23/export-office-365-users-logon-history-report/
Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.



If an Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.




1.png (6.4 KiB)
· 3
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thank you Casey, but that appears to be the same log that does NOT log blocked IPs. As I mentioned, users do not show up in authentication logs because they never get to the point of authenticating. Looking for a log that shows IPs blocked by Network Location Access Control.

0 Votes 0 ·

Hi anonymous user

per my test,there is no log to show blocked ips in sharepoint online.

0 Votes 0 ·

Thanks. That seems to be what we discovered as well. I don't know if SPO's correlation IDs contain the source IP address (the requesting user gets an "Access Denied" message back with a correlation ID) but we can't seem to get Microsoft to look up correlation IDs for us anymore. 😕

0 Votes 0 ·