I've detected a number of illegitimate logins to Office 365 (based on Client IP). In the audit log, the operation is listed as "ForeignRealmIndexLogonInitialAuthUsingADFSFederatedToken." I'm not terribly familiar with this logon type, and the MSDN articles didn't seem to provide the depth, only that it exists. Can anyone explain what this could possibly mean?

  • Looks like SSO login from a domain that your main domain has a trust relationship with. – TheJulyPlot Nov 7 '17 at 15:51
  • ADFS is federated active directory, that could be on-prem or in the cloud. Do you run Active Directory in Azure? have you set up any federated authentication? – iainpb Nov 7 '17 at 17:17

This is a fairly horrible entry in the combined audit log and Microsoft certainly don't make it easy to decipher.

It appears to happen when a users device with an on-prem AD account sync'd to Azure AD tries to authenticate.

From what I can tell, the IP address should be related to the client device - which may itself not be on-prem at the time of authentication.

There are a couple of support articles related. As often the case with MS web support, they are fairly inpenetrable. 1, 2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.