Meaning of Password in the Cloud + Correct Password

Jorge Sanz 6

Hello,

We got a diagnosis with Auth method="password in the Cloud" and Results="Password Correct". In a second step the MFA was required, the MFA btw failed. Does this mean that the password initially introduced was correct and then the login was not possible because the MFA failed? Does the authentication process first validate the passsword and once is correct it requires the MFA, or the password is not validated until de MFA is passed?

Detalles de la autenticación
Date Auth method Results Requirement
2022-09-03T09:48:39.0000000Z PasswordPassword in the cloud Correct password MFA is enforced for the user account.
2022-09-03T09:48:39.0000000Z MFA required in Azure AD MFA is enforced for the user account.

Best regards

1 answer

JimmySalian-2011 42,071 Reputation points

2022-09-29T10:46:26.157+00:00

Hi Jorge,

The password is first port of authentication and MFA is the second, as you know Azure AD multifactor authentication (MFA) helps safeguard access to data and apps while maintaining simplicity for users. It provides additional security by requiring a second form of verification .

User has used his account and this is using only user name and password as the primary authentication method. and MFA is enforced, password in the cloud means only Cloud based password and no writeback, that is when password writeback is not enabled, you can check in the configuration.

Hope this helps.

==
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.

1 person found this answer helpful.
Jorge Sanz 6 Reputation points

2022-09-29T11:06:10.67+00:00

Hi Jimmy, thank you very much for your prompt answer!

So, if I understood correctly, the password introduced was correct, isnt it? The problem with this is that the login attempt was done from an other country where the user never been there. Looks like this is a case of a stolen identity, would you agree with this?

We already asked the user to change his password, nevertheless we will try to understand how this could happened.

Best regards

JimmySalian-2011 42,071 Reputation points

2022-09-29T11:11:04.627+00:00

Hi Jorge,

I cant say as I dont have view or access to your CA logs for authentication, also if you have applied Conditional Access Policies you can delve deep into the logs to check the failure message and yes good process to change password if you feel account is compromised.

However do not forget to Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Jorge Sanz 6 Reputation points

2022-09-29T11:27:47.147+00:00

Hi,

Sure, I will check the logs. Sorry for insistin, but still something I dont grasp. If the MFA is not requested until the Password is validated, then, if the message states "Result:Password correct", that would it mean that the introduced password was right. And if the login attempt was made from a different country, that the user is not aware of, how could this mean that the account was not compromised?

Best regards

JimmySalian-2011 42,071 Reputation points

2022-09-29T11:30:48.113+00:00

Hi Jorge,

As I have not seen the logs I cannot say if the account was compromised or accessed from the other country it is admin of the tenant or the Security team that needs to investigate the logs. You can replicate the flow of the authentication and check in the signin logs. Hope this helps.

==
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Jorge Sanz 6 Reputation points

2022-09-29T11:54:10.88+00:00

Hi, would this help?

The user is based on Germany, and he was there when the login attempt happened.

Detalles de inicio de sesión
Detail Client submitted
User name xxxxxxxxxxxxx@xxxxxx .com
Application Office 365 Exchange Online
Client application Browser
Device name No Device Identity
Device identity No device identity
Operating system Windows 10
IP Address 197.210.71.88
Location Lagos Lagos NG
Sign in to comment

Share via

Meaning of Password in the Cloud + Correct Password

1 answer