Repeated AADSTS50034 username-does-not-exist responses indicating enumeration

Duo Tech@duotech

•updated Jul 14, 2026•7•0•6

Detects high volumes of authentication failures (AADSTS50034) targeting non-existent or invalid usernames from a single source IP address, potentially indicating account enumeration or password spraying activity.