Password Spray

Password spray is a brute-force attack pattern where an attacker tries a small number of common passwords (e.g., Spring2024!, Password123) against a large number of accounts, rather than trying many passwords against one account. The advantage to attackers: account lockout policies that trigger on N failed attempts against one account never fire, because each individual account sees only a few attempts. Microsoft Entra ID Identity Protection detects password spray patterns and flags affected users as risky. Microsoft Defender for Identity detects spray against on-prem AD. Mitigation: MFA for all users, Entra ID Smart Lockout, password protection (banning weak passwords), and ideally passwordless authentication which removes the password as an attack vector entirely.

Why it evades traditional defences

Classic account-lockout policy — lock the account after, say, five failed attempts — was designed to stop an attacker guessing repeatedly at one account. Password spray sidesteps that entirely by spreading guesses horizontally: instead of trying five thousand passwords against one account (which would trip the lockout on attempt six), the attacker tries one or two passwords against five thousand accounts. No single account ever accumulates enough failed attempts to lock, and because the attack usually targets a whole tenant's directory (often harvested from a company's public employee list or a breached email format pattern), a low per-account failure count is enough to eventually land on the handful of accounts still using a guessable password.

Worked example

An attacker obtains a company's email address format (firstname.lastname@contoso.com) from LinkedIn scraping and a public employee directory, builds a list of 3,000 likely addresses, and tries Contoso2024! against every one of them, spread across many source IPs to avoid a simple per-IP rate limit. Out of 3,000 accounts, perhaps three happen to be using exactly that password (seasonal-plus-company-name passwords are a well-known weak pattern). Entra ID Identity Protection flags the sign-in pattern itself as anomalous — many failed attempts across many accounts from related infrastructure in a short window — and marks the three successful sign-ins as risky, which a Conditional Access policy tied to sign-in risk can then force into a step-up MFA challenge or an outright block, even though the password guess itself was technically correct.

Layered defence, not one control

No single control fully stops password spray on its own. Smart Lockout throttles repeated attempts from a given source without punishing legitimate users elsewhere. Entra ID Password Protection (banned-password lists, both Microsoft's global list and a custom tenant list) removes the most commonly sprayed passwords — company name plus year, season plus year, "Password1" variants — from ever being valid in the first place. MFA means even a correctly guessed password isn't sufficient to sign in. Identity Protection risk detection catches the pattern even when a guess succeeds, closing the loop after the fact. Removing passwords from the equation entirely via passwordless authentication (FIDO2, passkeys, Windows Hello for Business) eliminates the attack vector rather than mitigating it.

Common pitfalls

A tenant that has MFA enabled but still allows weak, easily-sprayed passwords is safer than one with neither, but is still needlessly generating risky sign-ins and Identity Protection noise that a proper banned-password list would prevent at the source. Custom banned-password lists are also commonly forgotten entirely — the default Microsoft global list catches obvious terms, but a tenant's own company name, product names, and local sports teams are exactly the substitutions attackers try first, and only a custom list catches those.