Why Datacenter IPs are shown when a user logs in

Question

Why Datacenter IPs are shown when a user logs in

Jacques Oosthuizen 6

Scenario - A user's account is compromised and MFA is enabled on his account. It is company policy that if the password expired and if not changed within a certain amount of time the user's MFA details are reset too.

Audit logs - It was identified that the audit logs were not enabled on Mircorsoft 365 but due to the subscription they have Azure AD enabled. There was only 7days or less logs available.

It was noted that a perpatrator login occured from an IP: 20.228.205.171. From online searches it indicates a Microsoft DataCentre in Virginia US. However when the ligitimate user logs in it captures his origin location.

MFA was setup by the perpatrators and everthing was logged as from the mentioned IP.

Why is it that the IP identified relates to a datacentre of Microsoft when the perpatrators log in but when the ligitamate user logs in it captures his origin location correctly?

Givary-MSFT 35,916 Reputation points Microsoft Employee Moderator

2022-11-21T08:20:13.487+00:00

@Jacques Oosthuizen

Apologies for the delay in reaching out to you on this, just wanted to check does the issue still persists or not.
Vanbelle Koen 0 Reputation points

2023-06-22T08:02:42.12+00:00

Hi did you ever find out what the issue was? We have the same problem over here.
Johan Roux 5 Reputation points

2023-10-09T05:24:18.1733333+00:00

Please let me know whether you got a response on this issue, as we are having the same problem.
Jacques Oosthuizen 0 Reputation points

2023-10-09T06:02:50.3666667+00:00

@Givary-MSFT THe issue still persists. However it looks like it is dependent on how the enviroment is setup. I have another business account and it shows the ISP but the other business accounts show a data center in the US logged in but we know for a fact it it should actually show either the local ISP or a suspicious one. Is there another set of logs I can look at. The logs I have looked at thus far is: Azure logs(Interactive and non-interactive sigins), MSIlogins, Pureview audit logs, and security audit logs. However the all the logs indicate a data center logged in. For some reason with the two factor authentication in place, it seams that when you authenticate with your phone the data center handels all the queries and that is why the system logs the data center logging in. But this is just a theory. Is there any other logs we can obtain probably from the identified data center that shows the original ips logging in or a command that can add the required column?
Joel Williams 0 Reputation points

2025-08-10T17:14:47.1833333+00:00

Having same issue

Your answer

Givary-MSFT 35,916 Reputation points Microsoft Employee Moderator

2022-11-21T08:20:13.487+00:00

@Jacques Oosthuizen

Apologies for the delay in reaching out to you on this, just wanted to check does the issue still persists or not.
Vanbelle Koen 0 Reputation points

2023-06-22T08:02:42.12+00:00

Hi did you ever find out what the issue was? We have the same problem over here.
Johan Roux 5 Reputation points

2023-10-09T05:24:18.1733333+00:00

Please let me know whether you got a response on this issue, as we are having the same problem.
Jacques Oosthuizen 0 Reputation points

2023-10-09T06:02:50.3666667+00:00

@Givary-MSFT THe issue still persists. However it looks like it is dependent on how the enviroment is setup. I have another business account and it shows the ISP but the other business accounts show a data center in the US logged in but we know for a fact it it should actually show either the local ISP or a suspicious one. Is there another set of logs I can look at. The logs I have looked at thus far is: Azure logs(Interactive and non-interactive sigins), MSIlogins, Pureview audit logs, and security audit logs. However the all the logs indicate a data center logged in. For some reason with the two factor authentication in place, it seams that when you authenticate with your phone the data center handels all the queries and that is why the system logs the data center logging in. But this is just a theory. Is there any other logs we can obtain probably from the identified data center that shows the original ips logging in or a command that can add the required column?
Joel Williams 0 Reputation points

2025-08-10T17:14:47.1833333+00:00

Having same issue