Microsoft Entra ID Password Spraying and Sign-in Correlation

Shadows VMB@Vemorian_Mort

•updated Aug 23, 2026•25•2•82

This rule correlates Microsoft Entra ID (formerly Azure AD) risk events identified as 'passwordSpray' with subsequent sign-in logs from the same source IP address within a 60-minute window. This helps identify successful or suspicious authentication activity originating from an IP address previously flagged for password spraying attempts against a specific user account.