We want to detect password-spray attacks on Microsoft 365

Password spray looks different than brute force. Not a thousand attempts on one account, but a few attempts on a thousand accounts from rotating IPs. Account lockout does not catch it, you have to see it at tenant level.

Try this first

1. 1Enable Smart Lockout in Entra (default is 10 attempts per source per 60 seconds). Do not raise it, that backfires. Smart Lockout is the first brake.
2. 2In Entra ID Protection set the User risk policy to High and tie it to a Conditional Access policy that forces password reset. Identity Protection often sees sprays before logs do.
3. 3Build a Sentinel query on SigninLogs where ResultType 50053, 50126 or 50057 appears more than 20 times in 10 minutes from different UserPrincipalName values out of one IP. That is the classic spray pattern.
4. 4Disable legacy authentication completely. Sprays often go through legacy protocols (IMAP, POP, SMTP-AUTH) because they bypass MFA. Conditional Access, Block Legacy Authentication, for all accounts.
5. 5Geo-block or require MFA for sign-ins from countries you do not operate in. A spray from a random datacenter in Asia is then stopped before it can guess the password.

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.