Log entry with unexplainable IP address in OfficeActivity

MrBee 0 Reputation points
2026-10-08T06:45:31.2133333+00:00

Hi. Our OfficeActivity table shows an event occurred from an IP address that's part of Microsoft's block, but in a sub-subnet that has supposedly been reassigned to an ISP in Miami. We don't have anyone working from the US, so it raised some alarms.

The user is 100% sure they performed the activity triggering the log event from our office in Europe. They did this alongside some other events which have the IP address of our office, so it's really not clear why this one single event is linked to an ISP in Miami. There are no other events (sign-in, Office Activity) from this IP address.

My suspicion is that for some reason the event was proxied to one of Microsoft's servers, and that Microsoft has taken back control of the subnet the IP sits on but records have not been updated.

Can someone help me get this figured out so I can confidently close this as benign?

Microsoft Security | Microsoft Sentinel
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Rauh, Alexander 240 Reputation points
    2026-10-08T19:32:19.0466667+00:00

    Hello MrBee,

    Your suspicion is good, not everyone has this!

    For some services, the ClientIP in the audit log is the IP of a trusted Microsoft application for example Office on the web, calling the service on the user's behalf not the user's device. You can read it here:

    For some services, the value displayed in this property might be the IP address for a trusted application (for example, Office on the web apps) calling into the service on behalf of a user and not the IP address of the device used by person who performed the activity.

    To answer your subnet question, look the IP up in Microsoft's current Azure IP Ranges and Service Tags file which you can download here the file gets updated weekly. If it's in there, Microsoft uses it today and the Miami record you found is outdated.

    Can you tell me which OfficeWorkload the event shows?

    Best Regards

    Alex

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.