<div>
Change the account password immediately.<br />
<br />
IP blocking is almost useless as hacker can, and do, rotate the IP at whim.
</div>


Network Engineer 

kevinhsieh

Software Engineer

noci

arnold

System, Network, Security and Cloud architect

Boris K

<div>
Enable MFA to ensure that only authorized users can access the mail.<br><br><a href="https://docs.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/set-up-multi-factor-authentication?view=o365-worldwide" rel="ugc">https://docs.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/set-up-multi-factor-authentication?view=o365-worldwide</a>&nbsp;<br><br>
</div>


Jackie Man

President / Owner CARDA Consultants Inc.

Daniel Pineault

Infrastructure admin

Ibrahim Kasabri

nav2567

Principal Software Engineer

Dr. Klahn

<div>
David has the right of it. &nbsp;Three attempts should be the limit, &nbsp;then block that IP for at least a day. &nbsp;This will cut down on the trash in the logs quite a bit.<br />
<br />
Multi-factor authentication is great, it is very helpful when enabled, but it doesn't solve the problem you're seeing -- dumb bots that bang on an account continuously regardless of MFA and clutter up your logs.<br />
<br />
If you don't allow your users naked email access from outside your LAN (&quot;naked&quot; being &quot;from the internet at large and not through our secure VPN&quot;) [and for access from outside the LAN, only access via VPN should be the standard policy] &nbsp;then shut off access to email at the firewall.
</div>


Fractional CTO

David Favor

<div>
Account lockout provides protection against a brute force password-guessing attack. An account is locked after X failed login attempts, and can only be unlocked after a certain period of time. Beware, when implementing this protection you need to balance between protecting accounts from attack and protecting users from being denied authorized access. <br><br>Check following points to increase the security of your system:<br>• Requires strong passwords. More complex passwords are harder to identify through brute force or automated methods.<br>• Requires users to change passwords periodically and not reuse old passwords.<br>• Disable the account (at least temporarily) after a few failed logins and notify system operators that an attack may be underway.<br>• Provides a single, careful mechanism through which passwords can be changed.<br><br><a href="https://owasp.org/www-community/controls/Blocking_Brute_Force_Attacks" rel="ugc">https://owasp.org/www-community/controls/Blocking_Brute_Force_Attacks</a>&nbsp;<br><a href="https://owasp.org/www-community/attacks/Brute_force_attack" rel="ugc">https://owasp.org/www-community/attacks/Brute_force_attack</a>&nbsp;
</div>


<div>
are the access means failed or just an alert that it is being accessed?<br />
<br />
Get the IP, log date and time and report it to Google's abuse.<br />
<br />
Do you have a policy against users accessing their Company emails .. i.e. Are users permitted &nbsp;in their Gmail account to setup a process that will pull their O365 email in? Some prefer to use GMAIL as an aggregator of emails from other sources.<br />
<br />
This might be what you are seeing after the user changed their password.
</div>


<div>
<div class="content wysiwyg-content">
Our security monitoring system has detected an O365 mailbox account is being accessed from Madrid IP addresses from Google Cloud. &nbsp;It seens that the driven activities are not from a browser or outlook client and the access time is in the middle of the night. &nbsp;<br />
<br />
Does anyone has a suggest for example, is it possible to restrict acces and disallow some google IP ranges from accessing the mailbox?<br />
<br />
Any suggestion is appreciated. &nbsp;<br />
<br />
Thanks.
</div>
</div>


Our security monitoring system has detected an O365 mailbox account is being accessed from Madrid IP addresses from Google Cloud.  It seens that the driven activities are not from a browser or outlook client and the access time is in the middle of the night.  

Does anyone has a suggest for example, is it possible to restrict acces and disallow some google IP ranges from accessing the mailbox?

Any suggestion is appreciated.  

Thanks.

unusual email access activity

Office 365 is a group of software plus services subscriptions that provides productivity software and related services to its subscribers. Office 365 allows the use of Microsoft Office apps on Windows and OS X, provides storage space on Microsoft's cloud storage service OneDrive, and grants 60 Skype minutes per month. Office 365 includes e-mail and social networking services through hosted versions of Exchange Server, Skype for Business Server, SharePoint and Office Online, integration with Yammer, as well as access to the Office software. All of Office 365's components can be managed and configured through an online portal; users can be added manually, imported from a CSV file, or Office 365 can be set up for single sign-on with a local Active Directory using Active Directory Federation Services.

Microsoft 365

Operating system security (OS security) is the process of ensuring OS integrity, confidentiality and availability. OS security refers to specified steps or measures used to protect the OS from threats, viruses, worms, malware or remote hacker intrusions. OS security encompasses all preventive-control techniques, which safeguard any computer assets capable of being stolen, edited or deleted if OS security is compromised, including authentication, passwords and threats to systems and programs.

OS Security

Network security consists of the policies adopted to prevent and monitor authorized access, misuse, modification, or denial of a computer network and network-accessible resources. Network security involves the authorization of access to data in a network, and covers a variety of computer networks; conducting transactions and communications among businesses, government agencies and individuals. Networks can be private, such as within a company, and others which might be open to public access.

Network Security

Security is the protection of information systems from theft or damage to the hardware, the software, and the information on them, as well as from disruption or misdirection of the services they provide. The main goal of security is protecting assets, and an asset is anything of value and worthy of protection.  Information Security is a discipline of protecting information assets from threats through safeguards to achieve the objectives of confidentiality, integrity, and availability or CIA for short. On the other hand, disclosure, alteration, and disruption (DAD) compromise the security objectives.