I've detected a number of illegitimate logins to Office 365 (based on Client IP). In the audit log, the operation is listed as "ForeignRealmIndexLogonInitialAuthUsingADFSFederatedToken." I'm not terribly familiar with this logon type, and the MSDN articles didn't seem to provide the depth, only that it exists. Can anyone explain what this could possibly mean?
This is a fairly horrible entry in the combined audit log and Microsoft certainly don't make it easy to decipher.
It appears to happen when a users device with an on-prem AD account sync'd to Azure AD tries to authenticate.
From what I can tell, the IP address should be related to the client device - which may itself not be on-prem at the time of authentication.