Odd Recent M365 Compromises

Alright, I'm running into a wall and need some guidance.

​

We've had a few clients with M365 account compromises recently. Most, if not all have decent controls in place (MFA/Number Matching, Authenticator, GeoIp blocking, Legacy Auth disabled, etc).

Couple things to note:

First obvious suspicious sign-in are coming from within the United States. I tracked a few of the IPs to multiple VPN and/or proxy services, but a lot of them were Microsoft data centers.

The one compromise had …

account auth authenticator blocking clients coming controls cybersecurity disabled etc geoip guidance legacy m365 mfa running sign states things united united states