<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body dir="auto">
We had several users this morning whose o365 accounts were locked. Upon inspection we determined that brute force attacks had caused OWA to autolock the accounts. Unfortunately, this also locks the accounts in A.D., so it is a kind of DOS attack.
<div><br>
</div>
<div>We unlocked the affected accounts, but the locks eventually were reasserted. Talking with MS support there appears to be no easy defense against this kind of attack unless you’re able to whitelist specific public IP addresses for OWA users. We can’t, as
OWA typically is used by traveling staff coming from arbitrary public IPs. We are looking into Geo filtering as a mitigating measure. However, the attacks all seem to be originating from the Google Cloud. Perhaps we can implement conditional access policies
to add more protection. </div>
<div><br>
</div>
<div>We have three-factor authentication, and no MFA challenges occurred, so we’re confident the attackers didn’t have any usable passwords.
<div><br>
</div>
<div>I just checked the status portal link you provided, and I can confirm that that doesn’t load for us either. Right now we don’t have any locked accounts, and users seem to be able to access normally.</div>
<div><br id="lineBreakAtBeginningOfSignature">
<div dir="ltr">-mel via cell</div>
<div dir="ltr"><br>
<blockquote type="cite">On Nov 15, 2024, at 6:47 AM, Bruce Freshwater via Outages <outages@outages.org> wrote:<br>
<br>
</blockquote>
</div>
<blockquote type="cite">
<div dir="ltr">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]-->
<style>@font-face { font-family: "Cambria Math"; }
@font-face { font-family: Calibri; }
p.MsoNormal, li.MsoNormal, div.MsoNormal { margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; }
a:link, span.MsoHyperlink { color: rgb(5, 99, 193); text-decoration: underline; }
a:visited, span.MsoHyperlinkFollowed { color: rgb(149, 79, 114); text-decoration: underline; }
span.EmailStyle17 { font-family: Calibri, sans-serif; color: windowtext; }
.MsoChpDefault { font-family: Calibri, sans-serif; }
@page WordSection1 { size: 8.5in 11in; margin: 1in; }
div.WordSection1 { page: WordSection1; }</style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal">Any aware of any ongoing issues with o365? I can't get the page to download the desktop version of o365 apps to load. A user changed his password and can login to o365 on the web, but outlook/onenote/etc. on his desktop won't sign him
in, they just load indefinitely after he enters his new password. Teams and Onedrive are working for him though. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Also Status page isn’t loading fully: <a href="https://portal.office.com/servicestatus">
https://portal.office.com/servicestatus</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Regards,<o:p></o:p></p>
<p class="MsoNormal"><b><span style="color:black">Bruce Freshwater<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:9.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:9.0pt;color:black">Direct: </span>
</b><span style="font-size:9.0pt;color:black">412.722.1701<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:9.0pt;color:black">Mobile: </span>
</b><span style="font-size:9.0pt;color:black">412.292.0282<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:9.0pt;color:black">Main: </span></b><span style="font-size:9.0pt;color:black">866.707.5869<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:9.0pt;color:black">Fax: </span></b><span style="font-size:9.0pt;color:black"> 412.774.2469<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:9.0pt;color:black">Email: </span></b><span style="font-size:9.0pt;color:black"> </span><u><span style="font-size:9.0pt;color:blue"><a href="mailto:BFreshwater@SierraExperts.com"><span style="color:blue">BFreshwater@SierraExperts.com</span></a><o:p></o:p></span></u></p>
<p class="MsoNormal"><b><span style="font-size:9.0pt;color:black">Request Help: </span>
</b><span style="font-size:9.0pt;color:black"><a href="sim.sierraincidentmanager.com"><span style="color:blue">Support Portal (SIM)</span></a></span><span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:9.0pt;color:black">Sierra Experts </span>
</b></p>
<div><image001.png></div>
<o:p></o:p>
<p></p>
<p class="MsoNormal"><span style="font-size:9.0pt;color:black">2 Robinson Plaza, Suite 300, Pittsburgh, PA 15205-1017</span><span style="font-size:12.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;color:black">Our Services: </span>
<span style="color:black"><a href="http://www.sierraexperts.com/managed-services/"><span style="font-size:9.0pt;color:blue">Managed Services</span></a></span><span style="font-size:9.0pt;color:black"> |
</span><span style="color:black"><a href="https://www.sierraexperts.com/software-development/"><span style="font-size:9.0pt;color:blue">Development & Design</span></a></span><span style="font-size:9.0pt;color:black"> |
</span><span style="color:black"><a href="http://www.sierraexperts.com/telephony-and-voip/"><span style="font-size:9.0pt;color:blue">Telephony & VoIP</span></a></span><span style="font-size:9.0pt;color:black"> |
</span><span style="color:black"><a href="http://www.sierraexperts.com/hardware-and-software/"><span style="font-size:9.0pt;color:blue">Hardware & Software</span></a></span><span style="font-size:9.0pt;color:black"> |
</span><span style="color:black"><a href="http://sierradatacenters.com/"><span style="font-size:9.0pt;color:blue">Data Center</span></a></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:9.0pt;color:black">Stay Connected:
</span><span style="color:black"><a href="http://www.sierraexperts.com/"><span style="font-size:9.0pt;color:blue">Website</span></a></span><span style="font-size:9.0pt;color:black"> |
</span><span style="color:black"><a href="https://www.sierraexperts.com/about-us/"><span style="font-size:9.0pt;color:blue">Awards</span></a></span><span style="font-size:9.0pt;color:black"> |
</span><span style="color:black"><a href="https://www.facebook.com/SierraExperts"><span style="font-size:9.0pt;color:blue">Facebook</span></a></span><span style="font-size:9.0pt;color:black"> |
</span><span style="color:black"><a href="https://twitter.com/sierraexperts"><span style="font-size:9.0pt;color:blue">X</span></a></span><span style="font-size:9.0pt;color:black"> |
</span><span style="color:black"><a href="https://www.linkedin.com/company/sierra-w-o-wires"><span style="font-size:9.0pt;color:blue">LinkedIn</span></a></span><span style="font-size:9.0pt;color:black"> |
</span><span style="color:black"><a href="http://www.sierraexperts.com/about-us/blog/"><span style="font-size:9.0pt;color:blue">Blog</span></a></span><o:p></o:p></p>
<p class="MsoNormal"></p>
<div><image002.png></div>
<o:p></o:p>
<p></p>
<p class="MsoNormal"><a href="https://www.sierraexperts.com/2024-top-managed-service-provider/?utm_source=outlook&utm_medium=email&utm_campaign=press-release&utm_content=2024-channel-futures-msp-501"><span style="color:windowtext;text-decoration:none"></p>
<div><image003.png></div>
</span></a><o:p></o:p>
<p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<span>_______________________________________________</span><br>
<span>Outages mailing list</span><br>
<span>Outages@outages.org</span><br>
<span>https://puck.nether.net/mailman/listinfo/outages</span><br>
</div>
</blockquote>
</div>
</div>
</body>
</html>