As MSDN subscribers all members of our development team need to have a Microsoft account. Since September 2016 these Microsoft accounts get disabled, temporarily or permanently, with no explanation from Microsoft. For some of us the accounts were enabled back after confirming our identity using our mobile phones. For these accounts, the activity page shows multiple successful logins from a location in Amsterdam. The first time it happened to me I've quickly generated a really long password using KeePass and, for a while, the "Amsterdam logins" went away. Yesterday I've seen again one of these logins and one of my coworkers had again to prove his identity to get back access to his Microsoft account. Are these "unusual activity" real logins or is there an error in the Microsoft systems? Can somebody crack a KeePass generated password with 245 bits (64 chars long)? Where should we start investigating this situation which is greatly affecting our productivity? [EDIT] I've managed to match one of the IP addresses to the owner. See WhoIs information below: WhoIs IP 220.127.116.11
NetRange: 18.104.22.168 - 22.214.171.124
Parent: NET40 (NET-40-0-0-0-0)
NetType: Direct Assignment
Organization: Microsoft Corporation (MSFT) RegDate: 2015-02-23 Updated: 2015-05-27 Ref: https://whois.arin.net/rest/net/NET-40-64-0-0-1
OrgName: Microsoft Corporation
Address: One Microsoft Way
Comment: To report suspected security issues specific to traffic emanating from Microsoft online services, including the distribution of malicious content or other illicit or illegal material through a Microsoft online service, please submit reports to:
Comment: * https://cert.microsoft.com.
Comment: For SPAM and other abuse issues, such as Microsoft Accounts, please contact: Comment: * firstname.lastname@example.org.
Comment: To report security vulnerabilities in Microsoft products and services, please contact: Comment: * email@example.com.
Comment: For legal and law enforcement-related requests, please contact: Comment: * firstname.lastname@example.org Comment:
Comment: For routing, peering or DNS issues, please Comment: contact: Comment: * email@example.com Ref: https://whois.arin.net/rest/org/MSFT
OrgAbuseHandle: MAC74-ARIN OrgAbuseName: Microsoft Abuse Contact OrgAbusePhone: +1-425-882-8080 OrgAbuseEmail: firstname.lastname@example.org OrgAbuseRef: https://whois.arin.net/rest/poc/MAC74-ARIN
OrgTechHandle: MRPD-ARIN OrgTechName: Microsoft Routing, Peering, and DNS OrgTechPhone: +1-425-882-8080 OrgTechEmail: email@example.com OrgTechRef: https://whois.arin.net/rest/poc/MRPD-ARIN
Now, what do I understand from that: is Microsoft having a communication issue between its departments or is Microsoft having a security issue and somebody is abusing their network or is somebody using Azure to crack Microsoft accounts?
[EDIT] I've changed again the password on my account and enabled two-factor authentication. I haven't seen unusual activity for the last 5 days. Maybe this will help other people as well.