Threat Hunting - Geolocation and permitted countries

Question

Hello,

I am trying to actively look into unauthorized authentications and activity in our tenant. We are located in the United States, and 99% of our users also live there. As I work through the Threat Hunting queries and pull reports, I'm seeing authentication and file access outside the United States, when the user has never traveled to that location. The IP addresses associated often says "Cloud provider" and states it as a Microsoft IP address within the M365 space. Is it safe to assume these authentications are not my users if they are physically sitting in the U.S.? On top of that, we actively block VPN use inside our network and this is a policy, so users know this, and I'm fine breaking their VPN if that is what I'm noticing on our logs. I'm essentially just trying to understand if these IP addresses are really Microsoft and how I can narrow down our foot print proactively (and potentially break any current access that should not be allowed in countries that Microsoft does not have "cloud provider" servers.)

Thank you-

Answer 1

Hello @Adam in Education

Thank you for posting your query on Microsoft Q&A.

A Microsoft IP address or "Cloud provider" could very well be authentic traffic coming from Microsoft's global infrastructure. Verifying if these IP addresses are actually a part of Microsoft's owned blocks is crucial, though. Because of Microsoft's global cloud infrastructure, authentication may go through a Microsoft data center in another nation even if the user is in the United States.

Use resources such as Microsoft's official IP address ranges https://learn.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-ip-web-service?view=o365-worldwide to cross-check if the IP addresses are from a recognized Microsoft range in order to verify if it is indeed Microsoft.

For Example: you can use an IP lookup tool or services like WHOIS to verify whether the IP is owned by Microsoft or another provider. https://whatismyipaddress.com/ip-lookup

You may improve your access controls if you observe a pattern of behavior (for example, attempts at foreign authentication). You can reduce the chances of unwanted access by enforcing MFA for unknown locations and blocking non-US countries.

https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-by-location

Also, wanted to check if you have leveraged risk policies as an option.

Refer to this link for more detailed information - https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-risk-policies

Enable sign-in risk policy for MFA - https://learn.microsoft.com/en-us/azure/active-directory/authentication/tutorial-risk-based-sspr-mfa#:~:text=Enable%20sign%2Din%20risk%20policy%20for%20MFA

Even if users don't usually travel overseas, Microsoft's infrastructure can sometimes give a feeling that authentications are coming from overseas. For example, a valid authentication might originate in a different country simply because the authentication request is handled by a Microsoft server in a different region.

You can download the public IP range mapped to the geographical location, not limited to Azure, from the following. https://www.microsoft.com/en-us/download/details.aspx?id=53601

And the public IP range used by each Azure service can be downloaded from the following. https://www.microsoft.com/en-us/download/details.aspx?id=56519

I hope this clarifies things. Please contact us if you have any additional questions.

If this answers your query, do click Accept Answer and Yes for "Was this answer helpful". And, if you have any further query do let us know.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Best regards,

Sakshi Devkante