How to see who is trying to break into your Office 365 and what they’re trying to hack

We’ve all had spam and phish from compromised Office 365 systems. They’re a prime target for bad actors, as mail from Exchange Online is highly trusted, and with the automation tools Microsoft has developed hackers can use the Microsoft Graph APIs to programmatically send messages in the background, while the owner of the compromised account carries on working without knowing that their email address is hard at work for someone else.

SEE: Windows 10: Lists of vocal commands for speech recognition and dictation (free PDF) (TechRepublic)

Microsoft has been adding more and more security features to Office 365, as part of its Microsoft 365 platform, integrating it with Azure Active Directory’s tooling. It’s now begun the process of moving authentication from the relatively insecure basic HTTP authentication model to a more modern OAuth-based approach. This then allows Office 365 to implement push-based authentication using the Microsoft Authenticator app, reducing the risks associated with password compromises.

While most of Azure Active Directory’s security features require an enterprise Microsoft 365 account, an E3 or better, you can still get some benefit from Azure Active Directory from an Office 365 account. It’s worth using these tools to see what exposure you have to drive-by attacks, where techniques like password dictionary sprays are used to break into poorly secured accounts.

How to use My Sign-ins to spot attacks

Users can get a good picture of their exposure from their Microsoft 365 or Office 365 account page. This is a high-level management portal for the self-service elements of an Office enterprise account. Consumer accounts don’t get this level of control, as they’re based on a user’s Microsoft account, which doesn’t have the same level of access to Azure Active Directory.

You’ll see a lot of security tooling built into the Office 365 My Account page; it’s here you manage passwords and devices, as well as your privacy settings. However, it’s the “My Sign-ins” section that’s worth investigating, as this is where you’ll find a list of recent sign-ins and attempted connections. It’s a useful tool, as it shows where someone attempted to log-in from, what they were trying to connect to and what account they were trying to compromise.

SEE: 83 Excel tips every user should master (TechRepublic)

Using this tool with my own account, I could see a few legitimate logins from my browser, from my Office apps and from various Microsoft browser extensions I’d installed. However, there were also a set of attempted logins from Korea, South Africa, Sweden, Brazil, Ukraine, China, Libya, the Czech Republic, U.S.A., Argentina, Thailand, Russia, Vietnam, Japan and Colombia. And that was just in the last 24 hours.

Microsoft gives you the IP address of the attacker, geolocating the IP address and displaying the details alongside a map. If the service isn’t sure if an attempted sign-in might not have been you it will default to blocking it, but will check if it was you. Here you’re helping train the machine learning system that runs the security aspects of Azure Active Directory, so go ahead and mark those that definitely weren’t you.

The My Sign-ins page gives you advice on what to do if there are signs that your account has been compromised. You’ll be advised to change your password if necessary.

While the page gives you a lot of detail about your own particular account, administrators need more information, to track down possibly vulnerable endpoints and to see which users are being targeted most often.

How to get more detail from Azure Active Directory

Here you can start to take advantage of the tools built into Azure Active Directory. Log in with an administrator account to see all the available options for your tenant. The section you will want to explore is the Monitoring section, accessed from the left-hand pane of the Azure Active Directory portal. Click on Sign-in logs to see a list of all sign-ins from all your users.

The initial view is partially filtered, showing only the last 24 hours of activity. You can change this to show the last 7 days or a custom time interval. The table gives you plenty of information about each interaction, showing whether policies have been applied, and with separate views for interactive and non-interactive sign-ins. From here you can see the application being accessed and the type of authentication used. If you’re using multi-factor authentication, single-factor authentications are likely to be suspicious.

How to use Excel for deeper analysis

While the portal gives you some additional filtering options, including on fields that aren’t displayed in the browser UI, more detailed investigations may need tools like Excel or Power BI. The data can be downloaded as CSV or JSON, and is delivered based on any filters you have set. A good option for downloading a large dataset for analysis is to choose the seven-day view. This contains details of all your logins, interactive and automatic, and can be filtered in Excel using its table tools.

The first time I drilled down into Azure Active Directory’s data it was clear that attackers were going for the lowest hanging fruit, in my case still accessible POP3 and IMAP endpoints for Exchange Online. These can be turned off inside your tenant for all users, as with versions of Outlook for most platforms they tend to be unnecessary. If you’re using modern authentication users with access to these endpoints, you will need to generate app passwords as they don’t support two-factor authentication. This significantly reduces risk, as they’re high entropy, randomly generated passwords that don’t need to be stored outside of your applications. 

Other attacks include attempting to use Exchange Online’s authenticated SMTP connections. This is likely to be spammers looking for open relays to forward malicious messages, so ensure that you’ve locked down SMTP access. Some log-in failures aren’t malicious; we see many failed logins from JavaScript rendering errors in Microsoft’s own Editor browser plug-in.

The security tools built into Office 365 and Azure Active Directory go a long way to automating locking down your email servers. Even so, it’s still worth looking at the data they produce. You can see which accounts are most at risk, as well as spotting the services that bad actors try to leverage. The more you can lock down, the less you have to worry about—though one of the easiest ways to stop them getting into your systems and into your accounts is to enable multi-factor authentication and make it mandatory for all your users.

Microsoft Weekly Newsletter

Be your company’s Microsoft insider by reading these Windows and Office tips, tricks, and cheat sheets.
Delivered Mondays and Wednesdays

Sign up today

Also see