How to Stop Microsoft 365 Mailbox Sign-In Attempts from Multiple IPs
Question details
The user wants to prevent automated brute-force or spambot sign-in attempts against a Microsoft 365 user mailbox originating from thousands of rotating global IP addresses.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Reviewing Microsoft 365 sign-in logs and noticing a flood of failed authentication attempts.
- Observed behavior
- Frequent failed and malicious sign-in attempts are filling up the sign-in logs, predominantly using SMTP protocols from distributed IP addresses worldwide.
Ensure you have global administrator or security administrator privileges in the Microsoft 365 and Microsoft Entra ID admin portals before modifying authentication protocols.
Disable Basic Authentication and SMTP AUTH
Blocking legacy basic authentication and disabling SMTP AUTH is the most effective way to stop automated spambot attacks at the source.
Basic authentication allows automated attacks against legacy protocols like SMTP AUTH. Because malicious bots use thousands of rotating IP addresses, attempting to block individual IPs is ineffective. Disabling the vulnerable protocol outright forces modern authentication and stops the attempts.
Log in to the Microsoft 365 admin center, navigate to 'Users' in the left-hand menu, and select 'Active users'.
Find and click on the user account that is receiving the suspicious sign-in attempts to open the account properties panel.
Click on the 'Mail' tab in the user's properties panel, then select 'Manage email apps' under the Email apps section.
Uncheck the box next to 'Authenticated SMTP' to disable basic SMTP authentication for this user, then click 'Save changes'.
Enforce Conditional Access and MFA
Secure the targeted accounts by requiring modern authentication and blocking risky sign-ins through Microsoft Entra ID policies.
Boost Your Productivity with WPS Office
While securing your email server requires Microsoft 365 admin controls, you can streamline your daily document workflow with WPS Office. It provides a lightweight, free alternative to Microsoft Office with a familiar interface and comprehensive features.
- 1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Install WPS Office: Run the downloaded setup file and follow the quick on-screen instructions to install the suite.
- 3. Open Your Documents: Launch WPS Office and immediately start opening, editing, and saving your Word, Excel, and PowerPoint files without any formatting loss.
Frequently Asked Questions
Why doesn't blocking the attacker's IP address stop the sign-in attempts?
Automated brute-force attacks and spambots typically use distributed botnets with thousands of rotating IP addresses worldwide. Because the IP addresses change constantly, blocking individual IPs is highly ineffective.
How can I tell if any of the malicious sign-in attempts were successful?
You can review the sign-in logs in Microsoft Entra ID. Filter the logs by the affected user's name and check the 'Status' column to ensure there are no 'Success' entries originating from unknown or suspicious locations.
Will disabling SMTP AUTH affect my users' ability to send emails?
Disabling SMTP AUTH only blocks devices or applications that rely on legacy SMTP client submission, such as older network scanners or third-party mailing apps. Standard Outlook, webmail, and mobile app users using modern authentication will not be affected.
