Someone else successfully login without going through authenticator app!!??

Rob, I've read this before, and yes, when you connect through mobile it sometimes shows the activity from another place, but it is related to the mobile company you are using.

The issue here is that, at least for me, I wasn't using my mobile data to connect, because I don't use anything from Microsoft on my mobile phone. (Now I use the authenticator there, but my first successful sign-in from Canada was when I had only sms and e-mail as 2FA).

And those logins they don't trigger any kind of 2FA challenge. It just appears there.

But it must be some kind of background authentication or something like that, as we discussed.

Another interesting thing is that, for years, I've had multiple unsuccessful sign-in attempts on my account, from all around the globe. It happened everyday for more than 10 years. Until May of this year, when it stopped and only shows my attempts.

Now, a few weeks ago, this strange successful sign-ins started to happen, and it seems to be happening to more people. (But only us, paranoid enough to keep checking it all the time, may be noticing it). Maybe there is some relation?

So, I don't know if Microsoft is changing things or not, but the thing is that the activity log is finally starting to work how it should do (before, I could never see my current sign-in activities) but now we are facing this new kind of "bug" maybe?

Thomas,

I was involved in another thread back in the old Microsoft Answers Community forums before those were shut down a few weeks ago that discussed the probable reason most of those who'd been seeing attempted attacks against their Microsoft accounts saw them suddenly stop occurring around May of this year.

To summarize, many of those attacks were likely associated with the Lumma Stealer takedown that Microsoft and others performed back in May.

Disrupting Lumma Stealer: Microsoft leads global action against favored cybercrime tool - Microsoft On the Issues

Within another document that I believe was referenced in the one I just linked, there was also mention that a related criminal organization involved in the same situation had also been taken down, though that specific detail I may have found elsewhere.

The point though was that this other group was specifically known for the operation of extensive bot networks, which are often used in the management of such global command and control networks in order to perform password and other similar attack attempts against Microsoft accounts.

The fact that the official Lumma Stealer blog announcement above had come out exactly 10 days before those posting in the thread had also noticed the failed logging attempts had stopped, was suspiciously well timed, so it seemed reasonable to those affected that a likely secondary takedown of the associated bot network itself was the probable reason.

Thomas,

Per the fact you don't believe you've done anything that should trigger the request to authenticate to your Microsoft account, it really doesn't matter, since the 'background authentication' you mentioned is something that Microsoft may do for any number of reasons as I referred to in my earlier comment above, since part of the authenticator's operation, for example, requires knowledge of your [phone's] location, in order for them to confirm the device making the authentication request is likely to be you, also potentially resulting in your activity logs displaying an entry.

If the activity that causes the entry also generates a notification that it might be unusual activity, then I would obviously choose not to allow or respond to that request if it generated one from the authenticator, especially if I don't believe I did anything myself that should have caused it.

So are these new events and the older ones that displayed more often in the past related? Possibly, but it really doesn't matter since that wouldn't provide any useful information you could use to resolve them, while treating any new potential attack as completely separate from others is always the best way to ensure you're evaluating what's happening as clearly as possible, and not adding the potential confusion from outdated information.

Rob

Yes, I think I'll stop worrying about it, since nothing strange is happening.

I'm also glad Microsoft was able to solve those endless annoying log in attempts.

Thank you for all the information. But if you hear something new about those logins people are facing, please share with us! I'm really curious about what is causing it!

If is a bug or whatever on Microsoft's side of things it should be sorted out. I'm tired of seeing logins not from me from Iv6 locations and I'm tired of having to decide whether to "Secure your account" or not as I should not have to face that dilemma because I've got Passwordless login setup. Passwordless login should means just that. ("but from Microsoft its OK??") I don't understand technical reasons why it might be happening, I just want it not to happen!!! Further more why have an activity page at all if you can't rely on whether it's trusted or not.

Hi, thank you for your explanations.

I was just trying to find some official statement explaining why this is happening since it has never happened before.

Just for some clarifications, I'm in Brazil and I was really worried seeing successfull sign-ins from Canada, a place where I'm not even close to.

Also, I only have the Outlook and OneDrive apps on my ipad, that does not have mobile data, so it is only connected to my home wifi.

But yeah, I think it is probably some background thing going on. But it is still hard to have 100% peace of mind.

Thomas,

Yes, the Internet is confusing to those who don't understand how it truly works, since network connections don't necessarily go where or take the paths you might expect, since the best path is often not the closest, because the interconnected mesh of networks that make up the Internet aren't all equal, or possibly even operating stably at the moment a particular connection occurs, with packet drops and other issues causing random effects no one can predict.

Microsoft's authentication systems are global and redundant, quite obviously because you need to be able to login from anywhere you might currently be located in the world, so each data center and thus every 3rd-party ISP will display these authenticator and similar login services in likely thousands of places, resulting in connections to various locations nowhere near your personal location.

That might possibly be part of why the IPv6 or for that matter any phone wasn't being displayed by the Activity logs and maps, since the confusing fact that you'd appear to possibly one moment be in Brazil, then a few minutes and another app later in Canada, and then again somewhere the other side of the globe a few minutes after that, is something the typical consumer simply can't understand.

So simply blocking the display of these in Activity may have been the interim solution, though the seemingly random display of some of these authentication entries is now causing even more confusion due to their unexplained appearance.

My entire reason for trying to explain is that nothing in computing and especially Internet networks is a simple as it seems, especially as compared to the usually simple, single home network that most consumers are familiar with, while those of us who've worked in networking and with products from Microsoft, Google or others for decades have seen many similar situations in the past, just as I mentioned about the initial appearance of those IPv6 phone connections in Activity a few years ago,

Remember, IPv6 addresses don't have the same long history as the limited number (only 4.3 Billion) of iPv4 addresses which have existed since 1983, while both the huge potential number of IPv6 addresses (1,028 times as many), as well as the fact that theoretically, each IPv6 address can be located anywhere in the world unrelated to the location of any other having the very next or previous sequential set of numerals, so their location really has nothing to do with the number itself, making the idea of mapping all of them unlikely.

So, in all likelihood, no one at Microsoft changed anything recently and the true trigger for these random appearances for a subset of users of the Microsoft authenticator is actually something caused be someone else entirely, which either Microsoft didn't anticipate or even if they were aware, have no direct way of informing anyone affected by it anyway.

If your home Wi-Fi is connected to the Internet, then your device is as well, but without discussing your entire scenario completely I can't truly be certain what your particular situation might be, so I won't bother to guess unless you're still trying to understand some specific detail.

Suffice it to say, none of the descriptions I've seen about this set of network authentications occurring quite consistently on that same "MICROSOFT-CORP-MSN-AS-BLOCK", which a search finds described as follows exactly as you'd expect, concerns me.

"MICROSOFT-CORP-MSN-AS-BLOCK is an Autonomous System (AS) owned by Microsoft Corporation, which encompasses various internet services and products, including cloud computing and software."

I'd only be concerned if that sort of combination of consistent details weren't present and the connection attempts were displayed as occurring in portions of the world or on networks I'd find less trustworthy.

Rob