Failed logon attempts "password in the cloud"

ped 1

Hi,

I am looking at a user account which is repeatedly getting failed login attempts with the "Authentication method detail: password in the cloud".
All my legitimate failed login attempts show as "forms authentication" as expected.

What does the authentication method "password in the cloud" imply/mean as it is not documented? Someone circumventing ADFS?

Thanks,
Ped

Marilee Turscak-MSFT 34,306 Reputation points Microsoft Employee

2022-02-28T21:21:56.837+00:00

Hi Ped, Can you please share a screenshot of the "password in the cloud" failed login attempt? I believe this is related to the user changing the password in the cloud when password writeback is not enabled, and in this case they'll need to synchronize the on-premises account with the cloud account. But I would like to see a screenshot of what you are seeing to confirm.
ped 1 Reputation point

2022-02-28T21:33:53.587+00:00

Hi Marilee,

Thanks for your reply, this is the only user getting hit with login attempts:

2 answers

Romain PRACCA 6 Reputation points

2022-09-27T14:11:04.713+00:00

Hi @Marilee Turscak-MSFT ,

What does the authentication method "password in the cloud" imply/mean as it is not documented?

The page https://learn.microsoft.com/en-us/graph/api/signin-list?view=graph-rest-beta&tabs=http does not explain it.

Thanks
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment
Marilee Turscak-MSFT 34,306 Reputation points Microsoft Employee

2022-03-01T21:06:30.087+00:00

Hi @ped ,

I see in your screenshot that the Authentication Method Detail shows "password in the cloud" and "invalid username or password."

Based on the log at 2:24:52, the user is attempting to log into the Azure portal using only user name and password as the primary authentication method. The failure reason listed is that the user is entering the wrong credentials. The user might simply be entering the wrong credentials, or there could have been a password change in the cloud that was not written back on-premises.

The "password in the cloud" message is documented here: https://learn.microsoft.com/en-us/graph/api/signin-list?view=graph-rest-beta&tabs=http

Let me know if this helps and if you have further questions.

Thanks,

Marilee
Please sign in to rate this answer.
ped 1 Reputation point

2022-03-01T22:01:07.587+00:00

Hi Marilee,

Thanks for pointing this out.
What stands out to me though is that there is ADFS federation setup and I am unable to re-create login attempts via "password in the cloud". Instead it shows "forms authentication" as expected when I try to logon with this username.

I am curious on how to logon via password in the cloud as the login attempts in the screenshot are definitely malicious and not initiated by the user?

Marilee Turscak-MSFT 34,306 Reputation points Microsoft Employee

2022-03-01T23:37:57.433+00:00

Are you using MSAL-node by chance? Do you get a different result when you log in using the portal vs CLI for Microsoft 365? I know there were some issues reported where this error was showing when users were logging in with CLI for Microsoft 365. I'm reaching out to the product team to see if they know why this might be happening, and whether this is a misleading error message or whether this could be a malicious attempt/ADFS bypass.

Marilee Turscak-MSFT 34,306 Reputation points Microsoft Employee

2022-03-02T00:11:15.443+00:00

If the user has a valid refresh token or primary refresh token, the user won't need to go to ADFS. https://learn.microsoft.com/en-us/graph/api/signin-list?view=graph-rest-beta&tabs=http

ped 1 Reputation point

2022-03-02T16:01:19.51+00:00

Hi Marilee,

Any access aside from Browser access is restricted via conditional access policy. All these random ip address logons are attempted via browser.

Having been targeted with many phishing emails recently, would it be possible some highjacked a user session and is authenticating somehow to azure directly?

Marilee Turscak-MSFT 34,306 Reputation points Microsoft Employee

2022-03-02T23:42:15.683+00:00

I've reached out to the product team to check if that is possible, but I think the CA policy would have flagged the login as such.

ped 1 Reputation point

2022-03-03T14:42:45.433+00:00

Thanks for looking into this! Reviewing the signing logs under the conditional access tab shows "not applicable". We do have a number of conditional access policies that show under each of the other legitimate login attempts

ChristopherLonsberry-8040 6 Reputation points

2022-05-26T20:03:18.483+00:00

Following the link to the "List sign-ins" documentation, I see a couple of example responses that include "Password in the cloud" as an auth method, but no explanation of what that means. Do you have anything that explains what it means?
Sign in to comment