Many failed logins across different users
The pattern matters more than any single account. Look for repeated failures spread across the tenant.
Identity security guide
Password Spray Attacks
A password spray attack is a quiet account takeover technique: instead of trying thousands of passwords against one account, attackers try a small set of common passwords across many accounts. For a 20-person office, that might mean every mailbox receives one or two attempts every few hours rather than one account being hammered until it locks.
This matters because small businesses often have Microsoft 365 as the front door to email, files, invoicing, calendars, and client communication. A single weak password can become a mailbox compromise, invoice redirection, or internal phishing campaign. The goal is not to scare staff into impossible password rules; it is to close the predictable gaps attackers rely on.
The explanation
What it means
Password spraying is different from a normal brute-force attack. A brute-force attack focuses on one user and tries many password combinations. Password spraying reverses that pattern: attackers choose passwords that people commonly use, then test those passwords against a broad list of usernames.
The method is designed to avoid obvious lockouts. If your policy locks an account after ten bad attempts, an attacker may only try one password per account, wait, then try again later. The activity can look like background noise unless someone reviews sign-in logs across all users instead of only one mailbox.
How it affects small businesses
Professional offices usually have public staff directories, predictable email formats, and users who sign in from home, mobile devices, and client sites. That makes username discovery easy and makes unusual sign-in patterns harder to notice without centralized logging.
In a law firm or accounting office, one compromised mailbox can expose client conversations, tax documents, closing instructions, or payment discussions. In a clinic, it can disrupt scheduling and patient communication. The business impact is usually operational first: lost trust, urgent password resets, payment verification calls, and time spent reconstructing what the account accessed.
Mailbox access
Attackers may read mail, search for invoices, and learn who approves payments.
Internal phishing
A compromised staff account is more believable than an outside sender.
Cloud data exposure
If the account has OneDrive, SharePoint, or Teams access, email is not the only concern.
Warning signs
Signals to watch for
Attempts from unfamiliar countries, networks, or hosting providers
Sign-ins from locations where your staff do not work deserve review, especially when they target several accounts.
Impossible travel or rapid location changes
A user appearing in the GTA and then another country within minutes may indicate stolen credentials or automated attempts.
Repeated failures followed by a successful sign-in
A successful login after spray activity should be treated as a priority investigation item.
Reduce risk
First controls to put in place
Require MFA for all users
MFA prevents a guessed password from being enough on its own. Prioritize admins, finance, partners, and shared workflows first if rollout must be staged.
Use Conditional Access where licensing allows
Conditional Access can require MFA based on risk, location, device compliance, or user group, making enforcement more practical for small teams.
Block legacy authentication
POP, IMAP, and older protocols may not enforce modern MFA properly. Blocking them removes a common bypass path.
Review sign-in logs regularly
Microsoft 365 sign-in logs show failed attempts, locations, client apps, and risk signals that help identify spray patterns.
Use smart lockout and a sensible password policy
Avoid password rules that encourage predictable patterns. Combine length, banned password lists, lockout protections, and MFA.
What we look at during a review
When we assess identity security, these are the specific areas we check against your actual Microsoft 365 tenant.
Tenant-wide sign-in pattern review
We look for failures spread across users, unfamiliar client apps, repeated source networks, and successful sign-ins after failed attempts.
MFA and Conditional Access coverage
We check whether all human users are covered and whether exceptions are documented, intentional, and monitored.
Legacy authentication exposure
We verify whether POP, IMAP, SMTP AUTH, or older clients are still in use and identify safer replacement options.
High-risk account review
We pay special attention to admin, billing, finance, partner, and mailbox-delegated accounts because they create higher business impact.
Continue learning
More identity attack guides
Need this mapped to your own tenant?
We can review your Microsoft 365 sign-in posture, MFA coverage, Conditional Access policies, legacy auth exposure, admin roles, and mailbox permissions — practical and scoped to a small team.
no obligation~30 minutesGTA-based engineers
FAQ
Identity attack questions answered
4 results
CoverageAre identity attacks mostly a Microsoft 365 problem?
Microsoft 365 is a common target because email, files, Teams, and identity all meet there. The same principles apply to Google Workspace, accounting portals, CRM systems, and remote access tools.
SecurityCan MFA be bypassed?
MFA greatly reduces risk, but active session theft, phishing proxies, OAuth consent abuse, and compromised devices can still create access. That is why Conditional Access, endpoint protection, and logging matter.
SecurityWhat should we check first after a suspected mailbox compromise?
Revoke sessions, reset the password and MFA methods, review inbox and forwarding rules, check sign-in logs, inspect sent mail, and preserve audit logs before cleanup.
CoverageDo small businesses need separate admin accounts?
Yes. Admin accounts should be separate from daily email accounts, protected with strong MFA, and used only for administration.