Suspicious Login Issues

How to Investigate Amazon IP Addresses in Microsoft 365 Activity Logs

Aamir Naveed Akram Oct 22, 2026 868 views

Question details

A user is seeing US-based Amazon IP addresses in their Microsoft 365 activity logs while working from Canada and wants to determine if this indicates unauthorized access.

How to Investigate Amazon IP Addresses in Microsoft 365 Activity Logs

Product: Microsoft 365
Device & OS: not provided
Scenario: Reviewing activity and audit logs in the Microsoft 365 admin center for security and compliance.
Observed behavior: The activity logs display access from Amazon-registered IP addresses located in the United States, despite the user physically operating from Canada.

Before you start

Before escalating the issue, ensure you have your device's current public IP address handy and check if you are actively using any VPNs or proxy networks.

Solution 1Recommended

Check Local Network, VPN, and Third-Party App Configurations

Determine if the foreign IP address is a result of your own network configuration or integrated third-party services.

Many unexpected IP addresses in activity logs are not malicious but are caused by standard network routing or cloud services making legitimate API calls.

Disable VPN or Proxy Services

Temporarily disable any active VPNs or proxy services on your device. Generate a new activity in Microsoft 365 and check if the logs still show the US-based Amazon IP.

Review Third-Party Integrations

Check for integrated third-party applications or add-ins connected to your Microsoft 365 account. Many of these cloud services are hosted on Amazon Web Services (AWS) and will log their AWS IP when interacting with your data.

Verify with Your ISP

Contact your Internet Service Provider (ISP) to verify if they route traffic through Amazon AWS infrastructure, which can sometimes mask your physical location.

AWS Hosted Services: Because AWS hosts a massive portion of the internet, security tools, spam filters, and automated backup services frequently appear as Amazon IP addresses in Microsoft 365 logs.

Solution 2

Review Full Audit Details and Open a Support Request

If network factors do not explain the IP anomaly, escalate the issue to Microsoft Support for a detailed log analysis.

Free Microsoft Office alternative

Experience Secure and Lightweight Productivity with WPS Office

If managing complex Microsoft 365 admin settings, cloud integrations, and logs is overwhelming, consider switching to WPS Office. It provides a highly compatible, secure, and user-friendly offline and cloud office suite without the heavy administrative overhead.

1. Download the Installer: Visit the official WPS Office website and download the free installer for your operating system.
2. Install the Software: Run the setup file and follow the straightforward on-screen instructions to install the suite.
3. Open Your Documents: Launch WPS Office and open your existing Microsoft Office files directly with zero format conversion required.

Highly compatible with Microsoft Word, Excel, and PowerPoint file formats.Lightweight desktop design with fast launch speeds and low system resource usage.Provides secure local editing options to maintain full control over your files without constant cloud syncing.Free to download with a familiar user interface for seamless and instant migration.

microsoft office alternative - wps office

Frequently Asked Questions

Why do Microsoft 365 logs show Amazon IP addresses instead of Microsoft ones?

Many third-party applications, add-ins, and security filters use Amazon Web Services (AWS) for hosting. When these services interact with your Microsoft 365 account via APIs, their AWS IP addresses are recorded in your activity logs.

Can a VPN cause my location to appear differently in Microsoft 365 audit logs?

Yes. If you are using a VPN, your internet traffic is routed through the VPN provider's servers. Microsoft 365 will record the IP address and geographical location of the VPN server rather than your actual physical location.

How can I block a specific suspicious IP address in Microsoft 365?

Administrators can restrict access using Microsoft Entra ID (formerly Azure AD) Conditional Access policies. By defining a 'Named Location' with the suspicious IP address or range, you can create a policy to block all access originating from that location.

Microsoft Office Security Issues