Log entry with unexplainable IP address in OfficeActivity

Question

Log entry with unexplainable IP address in OfficeActivity

MrBee 0

Hi. Our OfficeActivity table shows an event occurred from an IP address that's part of Microsoft's block, but in a sub-subnet that has supposedly been reassigned to an ISP in Miami. We don't have anyone working from the US, so it raised some alarms.

The user is 100% sure they performed the activity triggering the log event from our office in Europe. They did this alongside some other events which have the IP address of our office, so it's really not clear why this one single event is linked to an ISP in Miami. There are no other events (sign-in, Office Activity) from this IP address.

My suspicion is that for some reason the event was proxied to one of Microsoft's servers, and that Microsoft has taken back control of the subnet the IP sits on but records have not been updated.

Can someone help me get this figured out so I can confidently close this as benign?

0 comments

1 answer

Your answer

Answer 1

Rauh, Alexander 240

Hello MrBee,

Your suspicion is good, not everyone has this!

For some services, the ClientIP in the audit log is the IP of a trusted Microsoft application for example Office on the web, calling the service on the user's behalf not the user's device. You can read it here:

For some services, the value displayed in this property might be the IP address for a trusted application (for example, Office on the web apps) calling into the service on behalf of a user and not the IP address of the device used by person who performed the activity.

To answer your subnet question, look the IP up in Microsoft's current Azure IP Ranges and Service Tags file which you can download here the file gets updated weekly. If it's in there, Microsoft uses it today and the Miami record you found is outdated.

Can you tell me which OfficeWorkload the event shows?

Best Regards

Alex

MrBee 0 Reputation points

2026-10-09T02:32:44.2333333+00:00

Hi Alex. I check the Azure IP Ranges and Service Tags file and I do not find the IP address in there.

The OfficeWorkload is Exchange.
Rauh, Alexander 240 Reputation points

2026-10-09T19:59:41.07+00:00

Hello MrBee,

The file I shared you only covers Azure so not finding the IP address there doesn´t mean the IP is not associated with Microsoft. You can also check all the Microsoft IP Spaces here this list contains all Microsoft's public IP blocks (IPv4 and IPv6).

Then compare that row´s Operation and ClientInfoString with the user´s other Exchange events e.g. Client=OWA or Client=WebServices. If you like post the IP (or just the first three octets) together with those two values, and i´ll check it against a list and do some research.