We run B2B multi-tenanted application on Azure. Each tenant has a subdomain on
tenant2.example.com, etc. Only login page is available to a world, everything else of the application is behind a login. Only a limited number of tenants with a pretty big contract to sign before you can get a login.
For a while our logs indicated that every so often (30-40 hits a day) we get 404 generated by
We don't have a tenant named
autodiscover and no such file to serve the requested query, so obviously goes to 404. However, as part of the query it provides an email address which is our real support email address.
autodiscover.json did not reveal how to deal with this and what causes it (no Referrer header on the requests), other than this is something to do with Office365 and MS Outlook.
Now my question - should I be concerned with this? Is somebody trying to configure Outlook client and slowly attempting different passwords? If this is a service, who should I contact to stop this? Is this something I should be providing as part of the appliacation? Is this part of Office365 configuration that somebody started but have not finished (the domain name is pretty old). Should I just redirect them to Ten Hours of Fun?