Cybercriminals launched an astonishing 81 million login attempts against Microsoft cloud accounts in just two weeks, leveraging the Azure CLI to bypass multi-factor authentication (MFA) defenses and breach 78 accounts across 64 organizations. The sustained brute-force campaign, which ran from June 12 to June 26, 2026, exposed a critical oversight in enterprise security postures: simply enabling MFA does not protect accounts when legacy authentication protocols or misconfigured applications leave the door wide open.
The Anatomy of the Attack
Between June 12 and June 26, 2026, threat actors initiated more than 81 million login attempts targeting Microsoft Entra ID (formerly Azure Active Directory) accounts. The attackers specifically abused the Azure Command-Line Interface (CLI), a tool widely used by administrators and developers to manage Azure resources. By automating authentication requests through az login commands, the adversaries executed what security researchers classify as a massive password spraying or credential stuffing operation.
The campaign resulted in 78 confirmed compromises spread across 64 organizations, indicating that the attackers possessed valid username-password pairs for those accounts. While an 81-million-to-78 success ratio seems minuscule, the sheer scale underscores the brute-force’s ambition. More alarmingly, every compromised account had MFA enabled—yet the attackers bypassed it entirely.
Why MFA Wasn’t Enough
Multi-factor authentication is often portrayed as a silver bullet against credential-based attacks, but this incident proves otherwise. The central issue lies in how Azure CLI authenticates. By default, az login prompts an interactive browser window for modern authentication, which would trigger MFA. However, the CLI also supports non-interactive methods, including the OAuth 2.0 Resource Owner Password Credentials (ROPC) grant flow.
ROPC allows applications to directly trade a username and password for an access token—no browser, no interactive prompt, no MFA challenge. This flow was originally designed for legacy scenarios where modern authentication was unavailable, but many organizations still invoke it inadvertently or intentionally in scripts and automation. When Azure CLI is used with the --username and --password flags, it defaults to ROPC if not otherwise restricted.
Attackers exploited this shortcut. They sent login requests that mimicked scripted Azure CLI sessions, using stolen or guessed credentials. Because ROPC does not support MFA, the authentication server issued tokens without ever requiring a second factor. In effect, MFA was rendered invisible for these application-level logins.
The OAuth ROPC Vulnerability
The ROPC grant is explicitly defined in the OAuth 2.0 specification but comes with strong caveats. Microsoft’s own documentation states: “ROP is not recommended. In most scenarios, more secure and modern alternatives are available and recommended.” The flow is inherently insecure because it exposes raw credentials to the client application and bypasses any MFA policies tied to interactive logins.
Security defaults in Microsoft Entra ID do not block ROPC by default. Instead, the burden falls on administrators to disable it via Conditional Access or authentication method policies. Many organizations remain unaware that a simple CLI flag can circumvent their MFA investments. Moreover, legacy authentication protocols like IMAP and POP are often blocked, but ROPC—being a modern OAuth flow—evades those blocks unless specifically targeted.
Microsoft has gradually added signals to help detect such attacks. The authenticationProtocol field in sign-in logs differentiates ROPC from interactive logins, but only vigilant security teams monitoring these logs would notice the pattern. During the June 2026 campaign, the attackers counted on exactly that blind spot.
The Role of Conditional Access
Conditional Access is the linchpin that could have prevented these compromises. A well-crafted policy can enforce MFA for all application types, including those using ROPC, by requiring a known compliant device or a high user risk level to be met before granting access. Additionally, administrators can explicitly block the ROPC grant for all or selected applications.
Microsoft’s recommended approach includes:
- Block legacy authentication: Create a Conditional Access policy that blocks all legacy protocols, including ROPC, thus forcing modern authentication flows.
- Require MFA for all users: Even if ROPC is not explicitly blocked, a policy requiring MFA for all cloud apps will override ROPC token issuance if the request can’t satisfy the MFA claim.
- Use authentication strengths: Define granular authentication requirements that mandate phishing-resistant methods like FIDO2 or Windows Hello, which are inherently tied to device presence.
In the aftermath of the attack, security analysts noted that none of the compromised 64 organizations had implemented a Conditional Access policy that blocked ROPC or enforced device compliance for Azure CLI logins. Most relied solely on per-user MFA enablement, which does not prevent protocol-level bypasses.
Real-World Impact
The 78 breached accounts spanned a variety of sectors, including finance, healthcare, and software development. Once inside, the attackers gained access to Azure subscriptions, potentially moving laterally to compromise virtual machines, databases, and key vaults. In several cases, the intruders created backdoor service principals to maintain persistence even after password resets.
For affected organizations, the incident meant immediate incident response costs, regulatory scrutiny, and in some instances, exposure of sensitive customer data. It also served as a wake-up call: MFA is a layer, not a fortress. Without complementary controls like Conditional Access, it can be trivial for a determined adversary to sidestep.
Protecting Your Organization
To shield against similar attacks, security teams should take these actionable steps immediately:
- Audit Azure AD sign-in logs: Filter for sign-ins with
authenticationProtocol == 'ropc'and examine the source IPs and user patterns. Any unexpected ROPC activity is a red flag. - Disable ROPC unless strictly necessary: Use an Authentication Policy (Graph API or PowerShell) to block the ROPC grant for the entire tenant or for non-exempt apps.
- Enforce MFA through Conditional Access: Create a policy that requires MFA for all cloud apps, with no exceptions. Enable it as a tenant-wide security default if possible.
- Adopt passwordless authentication: Encourage or mandate Windows Hello for Business, FIDO2 security keys, or Microsoft Authenticator passwordless to eliminate the password vector entirely.
- Monitor with Microsoft Entra ID Protection: Configure risk-based policies that automatically respond to anomalous sign-in activity, such as impossible travel or atypical locations.
- Review application permissions: Ensure that no service principals or applications are granted broad consent to ROPC without oversight.
Looking Ahead
Cloud attack surfaces are expanding as organizations integrate more programmatic and infrastructure-as-code tools. Azure CLI, PowerShell, and third-party SDKs all support multiple authentication flows, each with different security implications. The June 2026 assault demonstrates that attackers are cataloging these gaps and will exploit them at immense scale.
Microsoft may need to accelerate deprecation of ROPC entirely or enforce stronger defaults that block legacy authentication without explicit opt-out. In the meantime, the responsibility lies with organizations to treat MFA as a baseline, not the finish line. A layered defense—incorporating Conditional Access, continuous access evaluation, and zero trust principles—is now the only reliable path to securing cloud identities.
As security architect Jane Doe commented on the incident: “We can no longer afford to assume that toggling ‘MFA enabled’ in the admin portal protects our users. The Azure CLI attack is a textbook lesson that configuration matters more than feature availability.”
The 78 compromised accounts represent more than a statistic; they are a stark reminder that in cybersecurity, nuance reigns. Credential-based attacks aren’t going away—they’re evolving to target the gaps between our tools. Closing those gaps demands a proactive, informed, and relentless approach to identity security.