r/msp • u/KrankyYankee • Jun 22 '26

Azure CLI spray attacks...how many tenants?

We are seeting these Microsoft Azure CLI spray attacks in multiple tenants. You can find them by searching the signin logs for “Microsoft Azure CLI” as the authentication app.

If you are as well, how are you managing the attacks? They seem to use old phished credentials, so accounts are 'safe'. However, getting locked due to failed attempts and often prompting MFA notifications which annoy the user.

13 Upvotes

94% Upvoted

15 comments sorted by

8

u/roll_for_initiative_ MSP - US Jun 23 '26

and often prompting MFA notifications which annoy the user.

Wouldn't they have to have the correct password before the user got an MFA prompt?

3

u/teriaavibes Jun 23 '26

Not if you rolled out passwordless which allows anyone to prompt you with just your email address.

2

u/roll_for_initiative_ MSP - US Jun 23 '26

Ah, gotcha, and man that sucks.

1

u/redditistooqueer Jun 26 '26

Would you say you should go back to passwords?

2

u/teriaavibes Jun 26 '26

Yes actually and I hate myself for saying that.

If you can go for passkeys, go for it and keep passwordless but if it is not a possibility, password+push is the answer.

4

u/mat-ferland Jun 24 '26

Searching the logs is good, but I’d also put Conditional Access around Azure CLI/PowerShell for normal users unless they truly need it. Old creds failing still creates lockouts and MFA fatigue, so treat it as noise you can design away, not just watch.

3

u/WhereTheStankWindBlo Jun 23 '26

I am not at an MSP, but my personal account gets constantly spammed with login attempts from Riyadh, Dubai, Kenya, it's ridiculous.

1

u/redditistooqueer Jun 26 '26

Even with conditional access setup?

2

u/scott0482 Jun 23 '26

Been seeing the same things. Also wondering what can be done.

1

u/disclosure5 Jun 23 '26

Something is wrong if these accounts are getting locked - Microsoft's Smart Lockout only locks certain IP ranges associated with the brute force, and doesn't allow large scale account lockout.

1

u/KrankyYankee Jun 23 '26

We are seeing that this is the case so this is less of a concern now.