How Can Organisations Defend Against A Password Spray Attack?
By Taliah | | Microsoft Azure
For many organisations, cyber security is often about advanced malware, ransomware gangs, or zero-day vulnerabilities. And yet some of the most successful attacks are based on something much simpler: weak passwords and lapses in identity security.
This approach has proven highly effective in recent attacks on Microsoft 365 environments. Attackers managed to execute millions of login attempts against organisations in a matter of weeks during the 2026 Microsoft Azure CLI campaign, compromising dozens of businesses despite many having multi-factor authentication (MFA) in place. They didn’t exploit software bugs; they exploited inconsistencies in identity protection. Usernames and passwords remain one of the most appealing targets for cybercriminals.
Not knowing what password spraying is is no longer an option – it’s a critical component of user protection, Microsoft environment protection, and account compromise mitigation. Follow as we explain exactly how these attacks work, why they continue to be successful, how to spot the warning signs, and what organisations can do to shore up their identity security.
What is password spraying?
The meaning of password spraying (or ‘PW spray’) is quite simple. Attackers don’t try different passwords on one account, but instead turn the tables and try one common password on hundreds or thousands of usernames.
A typical attack might target an organisation’s employee directory with passwords like “Winter2026”, “Welcome123”, or other common passwords that are reused. If none of those work, attackers wait and try again with some other popular password. This slower method helps them avoid triggering traditional account lockout thresholds while still identifying users with weak or reused passwords.
The 2026 Azure campaign was a perfect case in point. Attackers were seen methodically testing exposed username and password combinations against Microsoft Azure CLI authentication by researchers. Rather than starting noisy brute-force attacks, they distribute authentication attempts across numerous accounts, making malicious activity appear much more similar to legitimate user behaviour. The result was an attack that was still very effective while avoiding many traditional security controls.
What is the difference between password spray and brute force attack?
One common mistake is to confuse the difference between brute force and password spraying.
A brute-force attack is when a hacker tries to guess a password by running through hundreds or thousands of passwords until they find one that works. This is typically done to one account at a time. This will often get your account locked out, rate limited, or flagged with security alerts pretty quickly.
A password spray attack, however, works horizontally, not vertically. Attackers try a few likely passwords against many accounts, often spreading attempts over several hours or even days. This greatly reduces the chance of lockout policies being triggered.
Brute force and password spraying require different defensive strategies, so it’s important to understand the difference. Brute-force attacks are easier to spot with repeated failures on one account, while spray attacks need to be monitored more broadly across an entire identity platform.
Likewise, organisations should understand password spraying vs dictionary attack methods, as the two techniques differ in both how credentials are tested and how they are detected. Dictionary attacks try lots of possible passwords against single accounts, while spray attacks deliberately limit password guesses to maximise stealth.
So password sprays, in short, are an authentication attack that exploits the benefits of poor password hygiene but avoids the controls many organisations use to detect suspicious login activity.
Why password spraying works
The attacks remain remarkably successful even when cyber security best practices are known widely. The biggest reason is simple: people still use predictable passwords.
Organisations often require complex passwords, but users frequently devise variations on seasonal phrases, company names or common words that are still relatively easy to guess. Some people still reuse passwords across multiple online services, which increases the odds that credentials compromised in previous breaches will eventually appear in criminal password lists.
But passwords alone are only part of the story. The Azure CLI campaign demonstrated that attackers are increasingly looking for gaps in identity controls and authentication policies, rather than relying solely on software vulnerabilities.
Some organisations only protected certain cloud applications. Others excluded particular user groups. Several relied on trusted network locations that unintentionally reduced MFA enforcement. Some had conditional access policies operating only in report mode rather than actively enforcing controls. Eight affected organisations had no effective MFA protection at all.
This makes an important point: Attackers no longer assume organisations have zero security. Rather, they look for inconsistencies in the implementation of security.
Modern identity attacks are increasingly targeting cloud authentication, where compromising a single account could potentially lead to access to Microsoft 365, SharePoint, Teams, OneDrive, and a variety of third-party SaaS applications.
As cloud identity attacks continue to evolve, understanding what password spraying in cyber security is, becomes an essential part of any organisation’s security strategy. Identity has become the new perimeter, and every authentication request deserves scrutiny.
What are the signs of a password spraying attack?
These attacks don’t announce themselves as a ransomware or malware infection would. Instead, they construct subtle authentication patterns that security teams must identify before a compromise occurs. Warning signs are:
- Large numbers of failed login attempts spread across many different user accounts.
- Authentication attempts originating from countries where your organisation has no business presence.
- Numerous login attempts from cloud hosting providers or anonymised infrastructure.
- Repeated Azure CLI authentication requests involving accounts that rarely use command-line administration.
- Multiple users experiencing unexpected MFA prompts despite not attempting to sign in.
- Successful logins following a prolonged period of failed authentication attempts.
- Increased non-interactive authentication events appearing within Microsoft Entra ID logs.
- Accounts authenticating through legacy or unusual authentication flows.
During the 2026 campaign, attackers created massive authentication volumes, spreading attempts across many identities. Researchers tracked more than 81 million login attempts in a two-week period, which gives you an idea of how automated these operations have become.
Successful password spray detection therefore relies less on counting failed passwords for individual users and more on analysing authentication behaviour across the organisation as a whole.
Security teams should also bear in mind that attackers rarely stop once they have obtained access. After finding valid credentials, they often rapidly move to establish persistence, get OAuth tokens, access cloud applications and expand privileges before defenders even know an account has been compromised. That is why continuous identity monitoring has become as important as strong authentication itself.
Inside the 2026 Microsoft Azure CLI password spray campaign
The recent Azure CLI campaign is a good reminder that credential attacks evolve as cloud technology evolves. The attackers didn’t rely on malware or newly discovered software vulnerabilities but instead targeted identity, knowing that access to email, collaboration platforms, cloud storage, and administrative tools could all be obtained through a single compromised account.
81 million attempts to authenticate with Microsoft environments is an absurdly large number. However, it wasn’t just the sheer volume that was impressive; it was also the systematic way the campaign was run that made it so noteworthy. Instead of guessing passwords on individual accounts, attackers used a small number of commonly used passwords on a large number of usernames, and requests were carefully spaced to avoid triggering traditional account lockout policies.
The campaign specifically targeted authentication using the Azure CLI. The Azure CLI is a legitimate command-line tool that administrators use to manage Microsoft Azure resources, automate deployments, and configure cloud environments. Azure CLI is widely used for administration and trusted by many organisations. Authentication requests coming from Azure CLI may not appear suspicious straight away without proper monitoring.
The attackers abused this trust by authenticating with the Azure CLI instead of the usual Microsoft 365 sign-in pages. This meant malicious login attempts could blend in with normal cloud administration activity. They also took advantage of authentication paths that were not always protected by the same conditional access policies as browser-based sign-ins.
The campaign also illustrated how cloud identity attacks have evolved beyond simply guessing passwords. The goal was to obtain valid credentials while trying to stay below the detection thresholds of many organisations. Once successful logins were achieved, attackers could move swiftly to establish persistence, access Microsoft 365 services, and, potentially, extend further into the environment.
The incident serves as a useful reminder for organisations assessing their own security posture. Strong passwords are still important, but only one layer of defence. Identity protection must protect all authentication methods, administrative tools and cloud services employees use.
For organisations assessing the risk of Azure password spray attacks, the campaign underlines the need to treat cloud identities as critical security assets rather than just user accounts.
How the attack bypassed MFA
One of the biggest myths that emerged from the incident was that multi-factor authentication had somehow failed. That wasn’t so.
Many of the affected organisations had MFA already enabled. The problem was that authentication policies weren’t always consistently applied to every sign-in method or authentication flow. Some conditional access policies blocked Azure CLI authentication entirely. Others were restricted to certain applications or users.
Some policies were working in a “report-only mode”, meaning they detected the risks but did not actually block them. Trusted network locations, legacy authentication methods, and incomplete policy coverage also created opportunities for attackers to authenticate without being subject to the same level of scrutiny as normal Microsoft 365 sign-ins.
In other words, MFA itself was not the weak link. The problem was in the configuration of identity controls.
This is important, as many organisations believe that the mere implementation of MFA is enough to secure cloud identities. The Azure CLI campaign showed that identity protection is only as strong as the weakest authentication path.
The incident also fits with wider industry observations. Security researchers have increasingly warned that attackers are combining credential attacks with OAuth abuse, token theft, device code phishing and session hijacking to circumvent traditional authentication controls. Instead of attacking the MFA itself, they exploit gaps before, after, or around the authentication process. For defenders, it emphasises the need for layered identity security.
Effective protection includes strong authentication and conditional access, continuous sign-in monitoring, behavioural analytics, identity risk scoring, least-privilege administration, and rapid incident response. Each layer compensates for weaknesses in another layer, and this makes it much more difficult for attackers to turn stolen credentials into a successful compromise.
How to prevent password spraying attacks
Understanding how to prevent password spraying begins with recognising that there is no single control capable of stopping every attack. Instead, organisations should build multiple defensive layers that work together to reduce both the likelihood and the impact of compromised credentials.
Strengthen password hygiene
The first priority should always be strengthening password hygiene. Users should be encouraged to create long, unique passphrases rather than relying on predictable combinations of names, seasons, or company terminology. Password reuse across personal and business accounts should also be actively discouraged, as credentials exposed in unrelated breaches often become valuable resources for attackers.
Enforce MFA consistently
Multi-factor authentication remains one of the most effective controls available, but only when it is implemented comprehensively. Organisations should regularly review conditional access policies to confirm that every authentication method, including administrative tools such as Azure CLI, receives the same level of protection. Report-only policies should be assessed carefully before production deployment to ensure they genuinely enforce security requirements.
Monitor authentication activity
Modern identity platforms also provide valuable detection capabilities. Monitoring sign-in logs, impossible travel events, unfamiliar device registrations, unusual authentication sources, and repeated failed login patterns can all provide early warning that an attack is underway. Rather than focusing solely on individual accounts, defenders should analyse authentication behaviour across the entire tenant to identify coordinated activity.
Reduce the attack surface
Disabling unnecessary legacy authentication protocols further reduces the available attack surface. Older authentication methods frequently lack modern security controls and remain attractive targets for automated credential attacks.
Protect privileged accounts
Privileged accounts deserve additional protection. Administrative identities should use phishing-resistant authentication wherever possible, receive enhanced monitoring, and operate under the principle of least privilege. Separate administrative accounts should also be considered to minimise exposure during day-to-day activities.
Build security awareness
Employee awareness continues to play an important role. While users cannot directly prevent automated authentication attacks, they can recognise unexpected MFA prompts, report suspicious account activity promptly, and avoid password reuse that increases organisational risk.
Prepare for compromise
Finally, organisations should prepare for the possibility that credentials will eventually be compromised. Continuous monitoring, rapid incident response, automated identity protection, and proactive threat hunting help reduce the time attackers remain undetected after gaining initial access.
The Azure CLI campaign demonstrated that successful defence depends less on any single technology and more on the combined strength of an organisation’s identity security strategy.
What to do if you think you’ve been targeted
Even organisations with mature security controls can become targets. The important thing is how quickly suspicious activity is identified and contained. If you believe your business has been affected by a password spray attack, taking quick action can significantly reduce the likelihood of a wider compromise.
1. Reset affected credentials immediately
Force password changes for any accounts showing suspicious authentication activity. Prioritise privileged users, administrators and accounts with access to sensitive business systems. Where possible, require users to create entirely new passphrases rather than variations of previous passwords.
2. Review sign-in logs
Check the Microsoft Entra ID authentication logs and your wider security stack for anomalous sign-in activity. Watch for repeated login failures, unknown locations, unexpected activity in Azure CLI, and successful logins after multiple failures.
3. Validate conditional access policies
Confirm that active conditional access policies are applied to all authentication methods. Look at exclusions, trusted locations, report-only configurations, and legacy authentication settings to see if there are any gaps attackers may have exploited.
4. Revoke active sessions and tokens
If you suspect account compromise, revoke active sessions and authentication tokens to force users to re-authenticate. This helps prevent attackers from maintaining access after credentials have been changed.
5. Investigate privileged accounts
Administrative identities need to be addressed immediately. Review role assignments, recent configuration changes and privileged activity to see if attackers tried to escalate their permissions after gaining access.
6. Enable additional monitoring
Watch for anomalous login behaviour, impossible travel, new device registration, and suspicious cloud admin activity to gain greater visibility across your identity infrastructure. Regular surveillance is necessary because attackers will often try to regain access after they have lost their initial point of entry.
7. Conduct a wider security review
A successful credential attack is rarely a one-off. Identify if sensitive data may have been exposed and investigate if compromised accounts were used to access email, SharePoint, Teams, OneDrive or other business applications.
8. Engage cyber security specialists
If the scale or complexity of the incident is uncertain, specialist support can accelerate investigation, contain the attack and reduce operational disruption. Experienced responders can also identify weaknesses that allowed the compromise to occur and recommend long-term improvements.
These steps form the foundation of effective password spray attack mitigation, helping organisations contain the immediate threat while strengthening their overall identity security posture.
How Syntax helps organisations stay ahead of credential attacks
Credential-based attacks continue to evolve because they exploit one of the few attack surfaces every organisation depends on: user identity.
Protecting against Microsoft password spraying, therefore, requires far more than password policies alone. Organisations need continuous visibility across their environments, proactive monitoring, and security controls that adapt as attackers change their tactics.
Syntax helps businesses strengthen their identity security through a layered approach that combines prevention, detection and rapid response.
Our managed cyber security services provide continuous monitoring designed to identify suspicious authentication behaviour before attackers can establish persistence. Rather than relying solely on static rules, ongoing threat monitoring helps organisations recognise abnormal login activity across cloud identities and business-critical systems.
For organisations looking to strengthen their overall security posture, Syntax’s IT security services combine identity protection with broader cyber security controls, helping reduce risk across users, endpoints and cloud infrastructure.
Microsoft environments also benefit from enhanced visibility through Microsoft Azure Sentinel, enabling security teams to correlate authentication events, identify emerging attack patterns, and investigate unusual sign-in behaviour far more quickly than manual log reviews alone.
Security is only one part of resilience. As credential attacks become increasingly common, organisations should also consider how cyber incidents may affect business continuity. Syntax can advise businesses on business cyber security insurance, helping organisations understand how technical controls and insurance work together to reduce financial and operational risk following a cyber incident.
Most importantly, Syntax works proactively with organisations to identify weaknesses before attackers do. Regular security assessments, identity reviews, and monitoring help ensure that cloud authentication remains protected as Microsoft environments continue to evolve.
So, if you’re defending against Microsoft password spray activity or preparing for future identity-based threats, adopting a layered, continuously monitored security strategy gives organisations a far stronger foundation than relying on passwords alone.
To learn more about strengthening your organisation’s cyber resilience, explore Syntax’s managed cyber security services or contact the Syntax team today.
