How do you detect password spray against AD FS with the Microsoft Entra Connect Health risky IP report?

What the risky IP report is actually telling you

The microsoft entra connect Health risky IP report is most useful when you read it as an aggregation layer, not as a verdict. It helps you spot source IPs or networks that are repeatedly generating failed sign-ins across many AD FS accounts, which is the classic shape of a password spray rather than a single-user lockout problem.

A useful triage pattern is low failure volume per account, broad coverage across users, and repetition from the same source over time. That combination matters because password spray is designed to stay below obvious lockout thresholds while still testing many usernames.

For a practical workflow, treat the report as the first filter, then confirm the pattern in AD FS sign-in logs. The report tells you where to look; the logs tell you whether the failures line up with one source, one time window, and the same authentication path.

How to separate password spray from ordinary failed logons

Password spray usually looks different from random user error or one account under attack. A single person mistyping a password will typically create dense failures against one identity, while spray spreads failures thinly across many accounts from the same source.

Use that distinction to look for repeated failures that are distributed across users rather than concentrated on one user. If the source keeps appearing in the report and the failures remain steady without a quick success, that source deserves escalation.

In AD FS environments, the most convincing indicator is correlation across the report and the authentication logs. Look for the same IP or network generating a long tail of failures across different users, especially when the pattern persists before any successful sign-in.

This is where a broader hardening view helps. Detection is stronger when AD FS, Entra ID, and hybrid identity controls are monitored together, because spray often targets the easiest authentication surface first and then pivots when one path becomes noisy.

What to check before you trust the finding

Not every repeated failure is malicious, so you should test the context before you act. Correlate the source IP with user geography, VPN or proxy ranges, known office egress, and maintenance windows to avoid confusing legitimate shared infrastructure with an attack.

Then inspect whether the failures cluster around legacy or weaker authentication paths, because those are often more exposed to online guessing. If the same source is failing against many accounts and the pattern is not explained by a normal shared network, the report has likely surfaced real spray activity.

Password Spraying and Credential Stuffing Defence Guide is the most direct companion for interpreting this pattern because it covers the low-and-slow failure shape, detection signals, and the response actions that follow.

Active Directory and Entra ID Hardening Guide is also relevant here because it frames the hybrid identity conditions that make AD FS and Entra monitoring more effective as a combined detection surface.

Risk and Threat Considerations

Password spray is attractive because it scales without immediately tripping user-specific lockout logic. A source that touches many accounts with a steady failure pattern can gather valid credentials slowly, then use the first successful login for broader access or follow-on identity abuse.

Failure mechanism: The attacker rotates usernames while keeping attempts per account low, which lets the spray remain below obvious thresholds while still finding weak or reused passwords across the tenant.

Impact: One successful match can create the first foothold for account takeover, mailbox or app access, and further attempts against federated or adjacent identity systems.

Practitioner Guidance

What to prioritise: Start with sources that show repeated failures across many accounts and confirm whether the same source also appears in AD FS logs, Entra Connect Health telemetry, or network records. If the report is noisy, prioritise the pattern that spans the most accounts over the source with the highest raw failure count.

Decision rule: If the source is external, unfamiliar, and failing across many accounts in a short window, treat it as probable spray until proven otherwise. If the source is internal or a known shared egress point, verify whether the timing matches a business process before escalating.

Practitioner takeaway: The report is strongest when it is used to confirm a distributed failure pattern, not just to count failed logons; the key judgement is whether the same source is probing many accounts in a way that suggests intentional password spray.

Related resources from NHI Mgmt Group

• How do security teams detect password spray attacks against Entra ID before they become a breach?
• How do you migrate AD FS applications to Microsoft Entra ID?
• How does Microsoft Entra smart lockout protect against password spray and brute-force attacks?
• Why should you migrate applications from AD FS to Microsoft Entra ID?