Activesync setup microsoft block access with Unusual Activity detected

I have 2 accounts with hotmail.ca domain. I have set them both up to use activesync and they both work fine. Today one of the accounts will no longer sync and prompts for a password. I enter the password and it failed with server error “”.

I deleted the account and tried to re-add with “exchange” setup. It fails with auth error. I went to my Microsoft account and under Security/sign-in activity I see an unusual Activity detected. The IP address it displays is NOT my IP address (it’s an IP in the US not Canada). If I look at the history this only started to happen today.

With the account that works I checked the history and all the account sign-in are from my IP address in Canada

It seems that for some reason the emClient is not using my IP address (in Canada) to authenticate. I don’t know why it’s happening on just that account and not my other one.

Any ideas ?

Thanks

Note I can setup the account as IMAP no problems.

Well I fixed this by going to my microsoft account and clicking on the secure my account which forces a password reset. After that I can setup the activesync. What is interesting is the IP address is still showing the US IP address not my actual IP address

Well the same thing happened to my other hotmail/outlook account. Has something changed in emClient backend or an proxy is being used ? because the IP address according to Microsoft that emClient uses to authenticate is 13.101.140.15 not my actual IP address.

Anyone else seen this with outlook activesync ?

Yes, getting the same thing here today as well. emclient version 9.0.1708
Only happens with my hotmail.com account. My outlook.com account is just fine.

To clarify both accounts are setup to use Exchange Web Services.

And yes, I’m seeing the same IP range as you for “unusual activity” whenever emclient tries to login:
13.101.85.236

My IP is through Verizon (I see THAT IP if I use web client) which is completely different. Seems emclient is using some sort of proxy or something and that’s a bit disturbing, IMO.

We don’t use ActiveSync. The account can either be setup with IMAP, in which case AirSync is used to sync the calendar and contacts, or Exchange (EWS).

Both the IP addresses mentioned here belong to Microsoft, so eM Client is not the cause of those.

Glad it’s not just me. I wonder if it could be a Microsoft thing rather than a emClient. I doubt emClient would be setting up proxies but what do I know.

1 Like

Thanks. Seems very odd that MS would block their own servers/systems. Although myself and OP seem to see the issue with the “legacy” hotmail.com domains vs. the outlook.com one. Although won’t be the first time MS has screwed up with O365.

I just noticed that on my android phone I use bluemail with activesync and I checked the sign-in activity and I see that from my Android the IP address is my real IP address… Very strange

So doing a wireshark trace, I see my clients go to O365 IP of:
52.96.109.130. They never go anywhere else. So my guess is that that particular MS server (or set of servers) then goes to the 13.101.x.x IP and that’s where it dies.

Since changing the password seems to fix it (for you), that leads me to believe that there’s an MS Azure sync issue (perhaps MS stood up some new servers and it doesn’t have correct mailbox account info). We’ve had that happen with O365 at my work place before.

I may try changing my password to see if that resolves the issue. If it does, that kinda cements it (for me) that it’s an MS Azure problem.

Not sure if I want to wait a day or two (typical Azure sync times to resolve).

Well, changing the password doesn’t fix it for me at all.

Sigh

I’ve got the auth logs, looks like some MS servers just think it’s not authorized for some weird reason. Only other thing I can think of is to install Outlook (yuck) and see what happens.

Well this is interesting. Outlook app has no issues at all. EMClient, however, doesn’t work.

So, someone on the microsoft forums replied to my post:

https://answers.microsoft.com/en-us/msoffice/forum/all/hotmailcom-unusual-activity-detection-from-ms/91ee598b-2399-4cb2-93d6-8f0695fb2259?messageId=71312148-b4fa-467a-b888-d943772ecb64

As for me, resetting the password did NOT fix the issue. Ironically MS Outlook worked just fine (but I did the “automatic” setup so I don’t know if it was using IMAP/POP/Activesync). If I re-setup emclient to use the “hotmail.com” it uses POP/IMAP/Activesync and that worked.

What I did notice though is that when outlook configured, it took me to my Account page to allow the app access, so that kinda clued me in to create an app password and then I put THAT into my Emclient setup for Exchange Web Services and it started working again.

Just an update since about the 22nd July all sign-ins have been from my IP address and none from the US IP address owned by microsoft