Microsoft Entra Repeated Bad-Credential Failures by User and Source IP

Lucas Pinho@lucaslapinho

•updated Aug 17, 2026•3•0•7

Detects ten or more Microsoft Entra sign-in failures for the same user from the same source IP within a five-minute window, identifying potential password guessing (brute force) activity against a single account.