Huntress reported on July 1, 2026 that it is tracking a massive, ongoing password-spray campaign aimed at Microsoft Azure CLI sign-ins. Same-day reporting on the Huntress research says the campaign involved more than 81 million login attempts against Huntress customers and compromised at least 78 accounts across 64 organizations.
The detail that matters for business owners is not only the size of the Azure CLI password spray. It is the control gap the campaign points toward. Huntress says the attackers used the OAuth Resource Owner Password Credentials flow, commonly shortened to ROPC, to validate credentials. That matters because many companies hear that MFA and Conditional Access are enabled and assume the account problem is solved.
Conditional Access is useful, but it is not a magic receipt. A policy can exist and still miss certain users, applications, authentication flows, service accounts, exceptions, or alerting paths. For a New Jersey business owner, the practical question is whether the Microsoft Entra tenant was reviewed against how attackers are actually trying to sign in.
The Business Decision Behind the Alert
This is a good moment to ask for evidence, not just a reassurance. If your provider says Conditional Access is already configured, ask what the policy covers, what it excludes, and whether Azure CLI and other command-line or legacy-style authentication attempts are being monitored.
The owner decision is simple: approve time for a focused identity-control review before the next account compromise turns into mailbox access, invoice fraud, data exposure, or emergency cleanup. That review does not need to become a sprawling project, but it should produce a written answer.
Questions to Ask Your IT Provider
- Did we review Microsoft Entra sign-in logs for Azure CLI, ROPC, legacy authentication, and unusual source networks?
- Are Conditional Access policies scoped to all users who matter, including administrators, shared accounts, service accounts, and break-glass accounts?
- Which accounts are excluded from MFA or Conditional Access, and who approved those exceptions?
- Are failed sign-in spikes, password-spray patterns, and successful risky sign-ins generating alerts that someone actually receives?
- If an account was hit by password spraying, what is the process for password reset, session revocation, mailbox-rule review, and follow-up monitoring?
What a Practical Review Should Produce
A useful review should leave the business with a short record of what was checked: sign-in log findings, policy coverage, exceptions, risky users, blocked authentication methods, alert routing, and any accounts that need credential rotation. The answer should be understandable to the owner, not only to the administrator.
This is also where vendor accountability matters. If Microsoft 365 or Azure administration is outsourced, the provider should be able to explain whether the tenant is protected against the current pattern and what evidence supports that answer. If the answer is only "we have MFA," the next question is where it applies, where it does not, and who is watching the gaps.
Password spraying is an old tactic, but the current Azure CLI campaign shows how old tactics keep finding new doors. The useful response is not panic. It is a calm review of identity controls before an attacker finds the exception first.
Sources and further reading
