password spray from Microsoft Azure Powershell

Question

A company is under a password spray attack against several identities from countries around the world.

The application is 'Microsoft Azure Powershell'. It is my understanding that there is no way to block this using conditional access policies. We already block for Windows Azure Service Management API but that does not stop the Microsoft Azure Powershell attacks. Is it true there is no way to block using CA Policies? We block most countries but we still have daily auth attempts from countries we cannot block.

thanks for any advice on how to handle.

Answer 1

You can immediately:

• Block authentication attempts are made from specific network ranges, like the ones from where the attack is being sourced.
• Restrict what users can access the affected application.
• Disable the application service principal in your tenant.

Depending on your specific scenario and licensing, more robust solutions or actions could be taken. For more information take a look at:

• Microsoft Entra security operations for user accounts
• Security operations for privileged accounts in Microsoft Entra ID