Azure CLI Password‑Spray Campaign Reveals MFA Bypass via Loose Conditional Access Policies
What Happened — Attackers leveraged the Azure CLI to conduct a low‑and‑slow password‑spray campaign against Microsoft 365 accounts. Because many organizations’ Conditional Access policies did not require MFA for CLI sign‑ins, the attackers were able to obtain valid credentials despite MFA being enabled for other clients.
Why It Matters for Compliance & Audit Readiness
- Demonstrates a gap in logical‑access controls that SOC 2 CC6.1 (User Access Management) is designed to detect and remediate.
- Continuous monitoring of Conditional Access policy changes and MFA enforcement provides the audit evidence needed to prove “least‑privilege” and “multi‑factor authentication” controls.
- Aligns with Verisq’s SOC 2 Access Controls capability, which automates policy‑mapping and evidences enforcement across cloud services.
Who Is Affected — Enterprises using Microsoft 365 / Azure (technology, finance, healthcare, education, etc.) that rely on Azure CLI for automation or scripting.
Recommended Actions
- Review and tighten Conditional Access policies to require MFA for all client applications, including Azure CLI.
- Enable Azure AD Password Protection and enforce lockout thresholds for sign‑in attempts.
- Deploy continuous monitoring of sign‑in logs and generate alerts for anomalous spray patterns.
- Map the updated policies to SOC 2 CC6.1 and CC6.2 controls and capture evidence in your audit repository.
Source: TechRepublic – Azure CLI MFA Gap
Technical Notes
- Attack vector: password‑spray via Azure CLI (non‑interactive authentication).
- No CVE; the issue stems from mis‑configured Conditional Access rules that omitted MFA for CLI.
- Potential impact: credential compromise leading to data exfiltration or further lateral movement.