First to begin my OS is Arch Linux(a base install mostly). I have project in the making and I have opened SSH. Yesterday I had left my computer for a few hours(3/4). When I was back in my log file I've seen someone has tried to break in trough my ssh and he has failed to break my root password. So my question is : The IP the hacker was using is supposed to be owned by Microsoft, so I was wondering if the hacker could've somehow faked their IP address with that of Microsoft(from their azure server)
This post has some useful information regarding IP spoofing. To put it shortly, it is not a trivial thing to do. For bi-directional connections, like SSH (which uses TCP), this would be even more difficult if not impossible.
Most likely, the source IP was legitimate and the attack came from an azure VM either purchased or compromised by the attacker.