Recent investigations reveal that attackers have exploited a Microsoft 365 sign-in pathway that eluded many multifactor authentication (MFA) policies. A password spray campaign aimed at Azure CLI sign-ins led to over 81 million login attempts between June 12 and June 26, 2026, as reported by Huntress. During this period, at least 78 Microsoft accounts across 64 organizations were compromised before the malicious activity ceased on July 2.
While the campaign did not breach multifactor authentication systems, it highlighted a significant issue for Microsoft 365 and Microsoft Entra ID administrators: Conditional Access policies can expose users when they only apply to specific applications, users, locations, or enforcement modes.
Exploiting Azure CLI as an Attack Vector
Attackers exploited compromised username-password combinations against the Azure CLI using the Resource Owner Password Credentials (ROPC) flow. According to the Huntress report, ROPC allows an application to manage a user’s password directly, bypassing the need for an interactive sign-in prompt. Microsoft has explicitly stated that ROPC is not recommended due to its incompatibility with MFA, and suggests using more secure alternatives whenever possible.
The vulnerability became apparent on June 22, when Huntress noted that in one day, 30 accounts across 23 businesses were affected. Notably, 15 of these accounts had MFA implemented and enforced via Conditional Access policies, yet these policies did not extend to the Azure CLI ROPC sign-in pathway.
Commonly recurring issues included limited policy scope and ineffective enforcement. Huntress identified MFA policies that were restricted to specific applications rather than encompassing all cloud apps, those that applied only to administrators, and trusted-location exceptions that unnecessarily weakened MFA requirements. In addition, several affected businesses lacked MFA policies altogether.
Huntress traced the majority of this malicious activity back to the IPv6 range 2a0a:d683::/32, associated with LSHIY LLC and AS32167. In a subsequent update, the company indicated that LSHIY had suspended the user service, bringing the attacks from this IP range to a close.
Strategies for Admins to Mitigate Policy Gaps
To mitigate these vulnerabilities, administrators should begin by reassessing Conditional Access policy scope. Microsoft’s guidance on blocking legacy authentication recommends including all users and resources within the policy, reserving exclusions solely for preventing potential lockouts.
Key areas for immediate checks include ensuring MFA policies extend to Azure CLI sign-ins, confirming that standard users are incorporated, evaluating the breadth of trusted-location exceptions, and identifying any policies remaining solely in a report-only mode. It’s essential for admins to also assess the necessity of Azure CLI access for non-administrative users.
Maintaining credential hygiene is another critical aspect of bolstering security. The attacks appeared to utilize outdated passwords that had not been rotated. Organizations are encouraged to evaluate potential credential exposure and mandate resets where necessary. Moreover, the rise of AI-driven identity attacks intensifies the need for robust access controls, while proper implementation of Windows Hello PIN security can mitigate the risk posed by stolen passwords.
Automation processes should also be rigorously examined. According to Microsoft’s Azure CLI documentation, service principals should be used for scripting, and the MFA requirement coming into effect in September 2025 applies to Microsoft Entra ID user identities, not workload identities like service principals or managed identities.
Security teams should conduct thorough reviews of Entra ID sign-in logs, focusing on non-interactive sign-ins, ROPC activity, Azure CLI authentication, and any traffic associated with AS32167 or the IP range 2a0a:d683::/32. Although the attacks from this IP range have ceased, organizations with similar gaps in their Conditional Access policies remain at risk.
Phishing attacks continue to be another significant entry point into trusted workflows, as evidenced by Microsoft’s recent investigation into a hotel phishing campaign in Japan.
