How do you defend against hackers using these to attack your SaaS server? You can't block a single IP because they are dynamic. You can't block the address range because some IPs are legitimate users.
This is a broad question. There are multiple ways to defend, besides basic security like firewalls. Blocking nefarious IPs or domains only gets you so far, as something will slip through the cracks. Try reading this: https://opsec101.org/
They keep trying to brute force a login. I block them after too many attempts but they just switch to a different IP in the same address range assigned to MS Virtual Desktop.
As explained in the original post, blocking an individual IP is ineffective and blocking the entire range is impractical because other legitimate customers use Virtual Desktop too.
I was hoping to avoid it but 2FA looks like the most reasonable solution.