MFA Fatigue and Password Attacks
| Attack type | Credential attacks |
| Threat actors | Password sprayers such as the Azure CLI campaign Huntress reported in 2026, botnets, access brokers and any attacker holding a stolen password |
| Coverage since | October 20, 2026; sign-in after a blocked attempt added October 23, 2026 |
| Platforms | Microsoft Entra ID |
The password is often already gone. Credential dumps, infostealers and reused passwords mean many attackers arrive with the right password in hand. What stands between them and the account is MFA, Conditional Access, and whether anyone notices them trying.
The threat
- Push bombing. The attacker has the password and sends MFA push after MFA push, hoping the user approves one just to make it stop.
- Slow brute force. Botnets spread their guesses so that each address makes only one attempt, invisible to any rule that counts failures per IP.
- Password spraying. Old breached passwords are tried across many accounts, low and slow, from rotating addresses. One campaign Huntress reported made more than 81 million attempts in two weeks against Azure CLI, whose password-only sign-in never shows an MFA prompt, and took over 78 accounts at 64 organizations.
- Blocked, then back. When a risk policy blocks the sprayer, they try the same password again from somewhere else, such as a residential address in the user's own country. Microsoft can rate that second attempt risk-free, and where MFA does not cover the sign-in, it succeeds.
- The right password, the wrong place. Conditional Access blocks a sign-in from an unmanaged device or a blocked country, but only after the correct password was entered. Whoever tried knows the password.
How Fluency catches it
- MFA fatigue. More than two MFA denials or timeouts for one user in an hour raise an alert, and so does a user reporting a prompt as fraud.
- Brute force, counted per user. Fluency counts failed sign-ins against each user, from any number of addresses, so a botnet that sends one attempt per IP is still caught. Password spraying across many users from one address is summarized in a daily report.
- Correct password, blocked sign-in. When Conditional Access stops a sign-in right after the correct password, Fluency flags it: the password is compromised, even though the attacker got nowhere this time.
- The sign-in after the block. When the same user then signs in successfully within two hours, from an address none of the blocked attempts came from, Fluency raises a high alert. That catches the Azure CLI password sprayer who is stopped once by a risk policy and comes back from somewhere else. Password typos, travel and moves between office and home do not trigger it.
- Microsoft's own risk signal. Sign-ins that Entra ID Protection rates high risk at sign-in time are raised too, alongside everything else Fluency knows about the user.
Detections included
| Detection | What it catches |
|---|---|
EntraID_MFA_Fatigue | More than 2 MFA denials or timeouts for one user in an hour. High. |
EntraID_MFA_Fraud_Reported | A user reporting an MFA prompt as fraud. High. |
EntraID_Brute_Force_User | More than 15 failed interactive sign-ins for one user in an hour, from any number of IPs. Medium. |
EntraID_Valid_Password_Blocked | Conditional Access blocking a sign-in right after the correct password. Medium. |
EntraID_SignIn_After_Block | A successful sign-in within two hours of a high-risk blocked attempt with the correct password, from another address. High. |
EntraID_High_Risk_SignIn | A sign-in Entra ID Protection rates high risk. High. |
MITRE ATT&CK
| Tactic | Technique |
|---|---|
| Credential Access | T1621 Multi-Factor Authentication Request Generation |
| Credential Access | T1110 Brute Force |
| Credential Access | T1110.003 Brute Force: Password Spraying |
| Initial Access, Persistence | T1078.004 Valid Accounts: Cloud Accounts |
Get this coverage
The detections are on every Fluency instance and need the Entra ID sign-in logs, collected through Azure Event Hubs or Microsoft Graph. Entra ID sign-in logs require an Entra ID P1 or P2 licence. The sign-in-after-block detection also needs Microsoft's sign-in risk rating, which the logs carry only with Entra ID P2.
Detection shortens an attacker's window; MFA closes it. Require MFA for all users, all cloud apps and all client app types, with no group, app, location or report-only exceptions, and restrict Azure CLI to the people who need it. Fluency watches for the attempts that still get through.
Not a customer yet? Start a free trial or book a demo.
Related
- Storm-2755: AiTM session theft: when the attacker skips the password and steals the session instead.
- Entra ID Detection Update: the full release, with triage guidance for each alert.
- Password-Spray Account Takeover Detection: the release notes for the sign-in-after-block detection, with its full match conditions, what it does not cover, and triage steps.