Conditional access policy not behaving as expected

Question

We have multiple C-Suite users being brute-forced with the FastHTTP Go library.

This is resulting in lockouts of our users, even though we have a conditional access policy that blocks legacy auth. Providing screenshots below of the CAP Config

Applied to all users (only 6 service accounts excluded)

Grant = Block Access and applied to "Other clients".

Here is sign-in log showing a 'Other client' brute force attempt - which should be blocked by the CAP, but its not being applied.

Open to any ideas here, looking to understand:

1. Why the CAP isnt performing as expected.
2. How to get these attempts blocked.

Happy to provide more info, thanks everyone!

Answer 1

Conditional access policies will not help you here, as they apply post (first factor) authentication (i.e. after username/password has been verified). Even if a CA policy blocks the login attempt, at this point the attacker knows credentials were successfully verified. Instead, you should block basic auth using the workload-specific controls, i.e. block SMTP auth for Exchange, block legacy auth via Set-SPOTenant, etc.

This doesn't mean you should not have a CA policy around this scenario, as it can still prevent bad actors from accessing your tenant. But it will not prevent brute-force attempts, or lockouts.