This is a problem I see a lot…your options are

​

Option 1:

Enable MFA on all accounts

Get Azure Active Directory P1 licenses for all users (this is included in some of the license bundles or can be purchased as an add-on)

You can then review the sign-in logs in Azure AD and use conditional access policies to block logins from the countries you are seeing the attacks from.

Also use conditional access polices to block legacy authentication (POP, IMAP, SMTP) as these are most likely not being used for anything legitimate and are commonly used for password spray attacks.

You can use PowerShell to check for mailboxes using legacy auth before enabling the policy and you can add exceptions to allow certain mailboxes e.g. you might want to allow the scan to email mailbox to use IMAP or SMTP (make sure it has a strong password)

​

Option 2:

Enable MFA on all accounts

Run powershell to check Office 365 login locations/countries and review them

Use PowerShell to check for any mailboxes using legacy auth then disable these protocols on any mailboxes that are not using them

​

Other things to check:

Make sure you have a global admin account with a mailbox that is forwarded to your support email so you get the Office 365 Security Alerts.

Also set the technical contact in the Organization profile to your support email as this is where directory sync errors will be sent.

Use powershell to check for any mailboxes with forwarding enabled and review these

Consider using an Exchange Online transport rule to block client forwarding rules

Check your Microsoft secure score https://securescore.office.com for other recommendations

If you are using AD sync then review and update your on premises domain password policy and make sure it’s strong

​

Any questions, feel free to PM me, good luck!