Azure Active Directory Conditional Access has functionality for “Countries/Regions” – see https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition
That said, the most effective protection you can have against password spray attacks is to enable MFA and disable basic authentication. If you cannot do this for your entire organization, then blocking user access to legacy protocols like POP, EWS, IMAP and SMTP is another step you can take. Exchange Online Client Access Rules can help you to further customize (https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/client-access-rules/client-access-rules). For additional recommendations, please see Office 365 Secure Score.
That said, please know that we are listening to feedback and working on solutions to help make Office 365 users more secure. Thank you for the feedback.
Thanks for sharing this with us. The team is looking at how to improve the O365 homepage. These are helpful details. Others should please comment with specifics as well if they have ideas on customization improvements. – Jay Waltmunson (O365 Program Manager)
An error occurred while saving the commentAnonymous commented
Why don't we have the ability to remove certain icons / links from the Office 365 Home Page as a Global Administrator. I don't want Bookings to show up for any of my users and there's no way to do this. I've removed all user licenses for bookings, turned the bookings feature totally off in the admin panel under Settings > Services & Add-ons and it still shows up for everyone. Even when I setup a brand new user account and only assign an Exchange license, nothing else, bookings is still on the Home Page. I know they can't user the bookings feature, but why can't we have control over removing the icon?
The same is true for the Business Center icon on the home page, which I don't want there and none of my users will access. Again, all licenses turned off for Business Center, and all apps that are part of it, but Business Center icon still shows on the Office 365 Home Page, confusing users after they click on it to see what it is and the notice says to ask their administrator..
We need more control!!