O365 email account compromised and perpetrator IP captured refers to a Microsoft Data Center

Scenario - A user's account is compromised and MFA is enabled on his account. 

Audit logs - Analysis of the mentioned email account PureView and Azure audit logs were conducted, and the IP address associated/used by the perpetrator(s), reflects as a Microsoft Data Center IP address, and not the private or public IP address actually used by the Perpetrator(s). 

However when the legitimate user logs into the email account, the logs captures such a user's private and/or public IP address and origin.

MFA also logged the perpetrator(s) IP address as a Microsoft Data Center IP address. 

Why is it that the IP identified relates to a datacenter of Microsoft when the perpetrator(s) logs in?

I would really appreciate all feedback on this issue.