we just found out that there are daily login attempts to some of our Microsoft accounts from suspicious locations in Asia, the US and other regions. All of our users are in Germany though.
I'm attaching a screenshot from our Azure AD portal, maybe somebody knows why this happens.
Cheers, Niclas
If all the users are from the Germany but the login attempts shows different region then it is someone is trying to access. I would recommend you to use location based Conditional Access policy to block the regions other than Germany. Along with CA policy kindly implement Azure AD Identity protection. Kindly check this documents. Kindly open a support case in order to get more details about the incident.