Azure CLI password spray exposes gaps in MFA coverage
A June 2026 campaign compromised 78 accounts across 64 organizations. The lesson is to verify authentication policy coverage, not simply whether MFA is enabled.
What was reported
Huntress recorded more than 81 million login attempts between June 12 and 26, 2026. Its investigation identified 78 compromised Microsoft accounts across 64 organizations. Attackers reused exposed credentials through Azure CLI sign-ins using the Resource Owner Password Credentials (ROPC) flow.
Why the MFA distinction matters
The campaign exploited incomplete Conditional Access coverage. It is not evidence that correctly enforced MFA was cryptographically broken. Microsoft explains that ROPC cannot complete an MFA challenge: when MFA is required for that authentication, sign-in is blocked. Microsoft recommends migrating away from ROPC to suitable interactive authentication or workload identities.
AZTCOFW perspective
Treat identity policy as something to test. Inventory the applications and automation that use password-based token requests, identify their owners, and plan migration before enforcing broader restrictions. Validate changes with representative accounts and keep a monitored emergency-access procedure.
Review successful as well as failed sign-ins, unexpected token use, and credentials known to have been exposed. Coordinate identity controls with network monitoring: a perimeter firewall alone cannot enforce every cloud identity policy.
These are editorial planning considerations. Use the vendor guidance below to assess the configuration of your own tenant.
