Password spraying in Active Directory and Entra ID: why controls fail

At a glance

What this is: This is a Semperis analysis of password spraying in hybrid identity environments, showing that broad, low-frequency password guessing still succeeds when weak passwords, exposed login paths, and missing MFA align.

Why it matters: It matters because identity teams need controls that reduce guessability and shrink exposure across both Active Directory and Entra ID, not just better alerting after repeated login failures.

Context

Password spraying is a credential-guessing attack that targets many accounts with a small set of common passwords so it can avoid lockouts and blend into normal authentication noise. In hybrid identity environments, that means the attack often lands where human login surfaces meet directory access, including Active Directory, VPNs, Citrix gateways, and Entra ID tenants.

Semperis frames the problem as a control gap, not a novel exploit. The issue is that password policy, MFA coverage, exposed internet-facing portals, and log visibility do not always line up across the full authentication path, so the same weakness can be reached from multiple directions.

For identity programmes, the point is not that password spraying is sophisticated. The point is that it keeps finding organisations where authentication hardening is uneven between on-premises directories and cloud tenants.

Key questions

Q: How should security teams detect password spraying in Active Directory?

A: Security teams should detect password spraying by correlating low-volume login failures across many accounts, not just repeated failures on one user. Monitor timing gaps, source reuse, and Kerberos pre-authentication failures such as Event 4771. Effective detection combines threshold rules, behavioural baselines, and investigation workflows that treat distributed guessing as a domain-wide identity event.

Q: Why do password spraying attacks evade common lockout controls?

A: Password spraying evades common lockout controls because each account receives only a few guesses, which keeps the attacker below per-account thresholds. The attack works by spreading attempts across many identities and stretching them over time, so the signal looks like normal background authentication noise unless defenders correlate activity across the directory.

Q: What are the signs that password spraying is being missed?

A: Look for low-frequency authentication failures across many accounts, attempts against multiple internet-facing portals, and sign-in activity that comes from distributed sources rather than one source. A pattern that stays just below lockout thresholds is a common sign that existing monitoring is too narrow.

Q: What should organisations do when password spraying is detected on internal accounts?

A: When password spraying is detected, organisations should force password resets for affected accounts, review authentication logs for successful compromises, and increase monitoring for repeat attempts. They should also notify users, enforce multi factor authentication where missing, and remove any shared or reused passwords from circulation. The goal is to close the initial access path and limit lateral access quickly.

Technical breakdown

Why password spraying avoids lockouts in hybrid identity

Password spraying distributes a low number of guesses across many accounts instead of hammering one account until it locks. That makes the attack less noisy and more likely to survive threshold-based lockout controls. In hybrid identity, the attacker can aim at Active Directory, Entra ID, or upstream portals such as VPN and Citrix gateways, then pivot into the directory path that still has the weakest password hygiene or the least MFA coverage. The technical failure is not merely weak passwords, but a defensive model that assumes repeated failure from one source is the main warning sign.

Practical implication: tune lockout, rate-limit, and anomaly controls for distributed guessing rather than single-account brute force.

How internet-facing login paths expand the attack surface

Password spraying usually succeeds where authentication is exposed through multiple front doors. VPNs, Citrix gateways, RDP gateways, and cloud sign-in endpoints all become candidate entry points if they are tied to the same identity backend. Once those portals are internet-facing, the attacker does not need direct directory reach to test credentials. The result is an identity attack surface that extends beyond the directory itself and into every externally reachable authentication service that trusts it. In practice, the risk grows when those systems are not retired, not monitored consistently, or not aligned with the same MFA and password policy baseline.

Practical implication: inventory and harden every internet-facing login path that authenticates against your directory or tenant.

Why SIEM alone does not close the detection gap

Centralising logs into a SIEM improves visibility, but password spraying is designed to stay just below the threshold that produces obvious alert patterns. Low-frequency attempts from distributed sources, including proxy networks, can look like ordinary failed logons unless detection logic is tuned to the attack pattern. Semperis also notes that attackers can evade SIEM-based detection, which means the control challenge is not log collection alone but correlating weak, repeated authentication attempts across portals, tenants, and directories. Detection has to recognise the attack as a distributed sequence, not a single event.

Practical implication: build detections that correlate low-and-slow credential attempts across identity systems, not just per-host failures.

Threat narrative

Attacker objective: The attacker wants account compromise that can be turned into privileged access, persistence, or downstream theft and disruption.

1. Entry occurs through low-frequency password attempts against many user accounts, often via internet-facing portals tied to Active Directory or Entra ID.
2. Credential access happens when one account accepts a common or weak password and the attacker avoids lockouts by spreading attempts across the estate.
3. Escalation follows when the attacker uses the initial access to reach higher-value systems, register devices, or deploy malicious applications with broader access.
4. Impact comes from unauthorized access to sensitive environments, persistence, or ransomware deployment depending on the actor’s objective.

Breaches seen in the wild

• Co-op cyber attack 2025: Attackers linked to Scattered Spider tricked their way into a Co-op employee account and stole personal data of all 6.5 million members.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Hybrid identity turns password spraying into a boundary problem, not a password problem. The attack works because Active Directory, Entra ID, and internet-facing portals often share the same trust chain but not the same control posture. That means one weak authentication path can undermine the whole identity programme. Practitioners need to treat directory and cloud sign-in as one exposure surface, not two separate teams.

Distributed guessing defeats controls built for repeated failure from a single source. Password spraying is effective because it is intentionally quiet, low-frequency, and spread across many accounts. Lockout logic, SIEM rules, and help desk processes often assume concentrated abuse, so they miss the pattern until access is already established. The governance gap is in detection design, not only password policy.

Exposed login portals are identity assets, not just infrastructure endpoints. VPNs, Citrix gateways, and RDP gateways are part of the authentication trust chain when they front Active Directory or Entra ID. If they remain internet-facing without unified policy and monitoring, they become durable entry points for credential attacks. The practical conclusion is that identity governance must extend to every public sign-in surface.

Password hygiene and MFA must be applied as a single control plane across hybrid estates. Weak passwords in one tenant or legacy environment still create risk for the whole programme when users or service paths are bridged. Semperis shows that the organisation’s real control boundary is the set of identities and portals an attacker can reach, not the product names of the systems involved. Security teams should measure consistency, not just control presence.

Credential Access is the right threat lens, but the real issue is access path sprawl. The attack aligns with a known adversary tactic, yet its persistence comes from fragmented identity architecture. When multiple portals, password policies, and logging paths exist, attackers need only one weak seam. The lesson for practitioners is to reduce the number of reachable authentication surfaces before chasing better detection alone.

What this signals

Hybrid identity demands one control model for all authentication paths. Password spraying shows how quickly a weakness in one portal or tenant becomes a programme-wide issue when directory trust is shared. The practical response is to govern sign-in surfaces as a single attack surface, not as separate on-premises and cloud concerns.

Distributed password guessing is a detection design problem. Organisations that rely on lockout thresholds alone will continue to miss low-and-slow attacks. The signal to watch is repeated weak authentication across many accounts and entry points, because that is where the pattern becomes visible before compromise scales.

For practitioners

• Enforce MFA on every internet-facing login portal Require MFA wherever a user can authenticate from outside the network, including VPNs, Citrix, RDP gateways, and cloud sign-in paths that federate to Active Directory or Entra ID.
• Harden password policy across the hybrid estate Set password controls so Active Directory and tenant authentication both reject weak, common, and compromised passwords, then verify that the policy applies consistently across all user paths.
• Retire unused tenants and exposed systems Decommission non-production Entra ID tenants and internet-facing systems that no longer serve a business function so they cannot be used as low-value entry points.
• Correlate low-frequency sign-in attempts in detection tooling Centralise authentication logs and tune detections for distributed low-and-slow guessing across many accounts, especially when attempts originate from proxy networks or unusual geographies.

Key takeaways

• Password spraying succeeds when weak passwords, external login paths, and uneven MFA coverage line up across hybrid identity.
• The attack pattern is designed to stay below lockout and alert thresholds, which makes distributed detection more important than isolated failure counts.
• Closing unused entry points, enforcing uniform password controls, and requiring MFA across all portals materially reduces the attack surface.

Key terms

• Password Spraying: A guessing technique that uses a small set of common passwords against many accounts to avoid lockouts and detection. It is effective when organisations do not reject common passwords, do not monitor patterns across identities, or allow too much standing access.
• Hybrid Identity: Hybrid identity is an architecture that connects on-premises directories with cloud identity providers and SaaS applications. It creates operational flexibility, but it also expands the blast radius of identity compromise across multiple systems that share trust and authentication dependencies.
• Internet-Facing Login Surface: An internet-facing login surface is any external authentication entry point that trusts the same identity backend as internal systems, such as VPNs, Citrix gateways, or cloud sign-ins. These surfaces matter because attackers can test credentials without first reaching the internal network.
• Credential Access: Credential access is the stage of attack where adversaries attempt to obtain valid account credentials or authenticate as an existing user. In password spraying, the goal is to turn weak or reused passwords into working access before other controls detect the pattern.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.