I've seen reports of password spraying involving Azure CLI and ROPC. Are you blocking that flow with Conditional Access, and what should be checked before doing it?
Are you blocking ROPC after the Azure CLI password spray reports?
Asked by
b84+windlass_306
Answers
Blocking ROPC is worth considering, but check for dependencies first. Applications using that flow send a username and password directly to the identity provider, so a block could break older scripts or integrations.
Review sign-in logs for resource owner password credential activity, identify the applications and accounts involved, then move them to a supported authentication method before enforcing a block. Test the policy in report-only mode where possible.
Reply to this answer
I wouldn't assume every Azure CLI sign-in used ROPC or that one policy covers every attack described in the reports. Check the actual sign-in details and test the policy against the flows you're trying to stop. Also review any accounts showing suspicious sign-ins or password spray activity.
Reply to this answer
One caution: ROPC doesn't support interactive MFA prompts. If an account can authenticate through it without an effective MFA requirement or block, that can leave a gap. Review Conditional Access policies and their exclusions rather than relying on the CLI label alone.
Reply to this answer
Add your answer
Answers are reviewed before publication.
~perhaps+sorted_3:
Good distinction. The reported attack is a reason to investigate, but the tenant's own sign-in data should guide the policy scope.