Entra ID WS-Trust Endpoint Can Enable Password Spraying Beyond Smart Lockout
Summary
Testing found that Entra ID’s legacy WS-Trust autologon endpoint can bypass expected Smart Lockout and standard sign-in logging while revealing valid passwords, including on accounts where MFA or Conditional Access blocks sign-in.
Key points
- The WS-Trust usernamemixed endpoint accepts username and password requests over the internet as part of a legacy Entra Seamless SSO flow.
- In testing, more than 1,000 failed attempts against one account did not trigger the expected Smart Lockout response or obvious throttling.
- Failed attempts were absent from standard Entra ID sign-in logs; the article says the Unified Audit Log can capture requests to the endpoint.
- AADSTS responses can distinguish invalid credentials from valid passwords blocked later by MFA, Conditional Access, or password expiration.
- The article outlines a spray workflow that first enumerates users, then filters accounts and interprets endpoint responses.
- Recommended mitigations include disabling usernamemixed, blocking legacy authentication with Conditional Access, monitoring the Unified Audit Log, and moving users to passwordless authentication.
Article Details
- Attack Vectors
- Password spraying against the WS-Trust autologon usernamemixed endpoint can bypass the expected Smart Lockout response and leave failed attempts out of standard Entra ID sign-in logs.
- AADSTS response codes can reveal whether a username exists and whether a password is valid, including when MFA or Conditional Access blocks completion of sign-in.
- Defensive Notes
- Disable the usernamemixed endpoint if it is not required for older Office 2013 clients.
- Block legacy authentication, including WS-Trust, through Conditional Access.
- If the endpoint cannot be disabled immediately, enable Unified Audit Log alerts for requests to autologon.microsoftazuread-sso.com; the article says standard sign-in logs do not capture its failed authentications.
- Move accounts to passwordless authentication, such as FIDO2 keys or Windows Hello, to remove passwords that can be sprayed.
MITRE ATT&CK
T1087.004 · Cloud AccountThe described workflow checks whether email addresses correspond to users in the Entra ID directory, using an API or endpoint responses to identify existing accounts.T1110.003 · Password SprayingThe article describes spraying a common or company-themed password across enumerated accounts through the WS-Trust autologon endpoint.
People
Vendors
Products
Azure ADIn 2018, Microsoft introduced Smart Lockout into Azure AD, now Entra ID, to make password spraying harder.Conditional Accessunfamiliar locations, while defenders watched the pattern through sign-in logs and relied on MFA or Conditional Access to block access if a password was guessed.Entra IDA legacy Entra ID endpoint kept alive for Office 2013 clients lets attackers spray passwords past Smart Lockout, confirm valid credentials on MFA-protected accounts, and leave only partial logs behind.FIDO2FIDO2 keys and Windows Hello remove the password from the equation entirely; there is no password to spray and nothing for the endpoint to confirm.Microsoft 365One of them is the WS-Trust autologon endpoint used by Entra Seamless SSO, which exists to help domain-joined machines sign users into Microsoft 365 in the background.Office 2013A legacy Entra ID endpoint kept alive for Office 2013 clients lets attackers spray passwords past Smart Lockout, confirm valid credentials on MFA-protected accounts, and leave only partial logs behind.Windows HelloFIDO2 keys and Windows Hello remove the password from the equation entirely; there is no password to spray and nothing for the endpoint to confirm.
Tools
AADInternalsthe autologon logging gap in 2021, and Microsoft classified the behavior as “by design.” Tools such as AADInternals and MSOLSpray have also automated pieces of the broader Microsoft cloud enumeration and sprayingMSOLSpraygap in 2021, and Microsoft classified the behavior as “by design.” Tools such as AADInternals and MSOLSpray have also automated pieces of the broader Microsoft cloud enumeration and spraying workflow.