If you are running Microsoft Office 365, someone is probably out to get you.
One way to investigate questionable Office 365 and other cloud sign-in activity is to use Microsoft’s Cloud App Security add on. To enable Cloud App Security, you must have an E5 license or purchase the Cloud App Security add-on.
To enable the alerts and monitoring capabilities, log onto the Office 365 Security and Compliance portal or the Microsoft Cloud App Security website. Browse to “Alerts” and click on “Manage advanced alerts” to review the options you have and what Cloud App Security monitors.
You can also add a module that monitors for Office 365 sign-in security (called Office 365 Cloud App Security) or Microsoft Cloud App Security, which monitors other cloud applications as well. Both can be added on to an existing Office 365 subscription.