Recommended Free Tools
Password spraying tests a small set of common passwords against many Microsoft 365 accounts, spreading attempts so individual accounts may not hit their lockout threshold. No single setting stops it: combine Microsoft Entra smart lockout, MFA, risk-based access controls where available, password protection, and monitoring matched to your authentication setup. If a password succeeds, investigate and contain the account promptly.
What password spraying looks like
In a password spray, an attacker tries one or a few likely passwords against many usernames rather than making repeated guesses against one account. That can evade per-account lockout rules. Smart lockout is useful, but Microsoft recommends additional identity controls and monitoring rather than relying on lockout or password strength alone. See Microsoft’s smart lockout guidance.
As an Amazon Associate I earn from qualifying purchases.
Start by identifying where authentication happens
Before searching logs, determine whether affected users authenticate directly with Microsoft Entra ID or through a federated identity provider. Include staged-rollout and mixed configurations; different users or domains may follow different paths.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute- Managed authentication, password hash synchronization, or pass-through authentication: review the applicable events in Entra sign-in logs.
- Federated authentication: failed password attempts may be recorded by the identity provider, so investigate its authentication logs and federation health telemetry as well as Entra and Microsoft 365 activity.
Correlate those records with firewall and SIEM data when available. Microsoft’s password spray investigation playbook covers investigation considerations across authentication designs.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Use smart lockout without disrupting legitimate users
Microsoft Entra smart lockout is enabled by default. Microsoft’s current documentation gives default thresholds of 10 failed attempts for public tenants and three for US Government tenants, with an initial lockout of 60 seconds; repeated lockouts can last longer. The last three bad password hashes are remembered in supported scenarios, so repeated submissions of the same incorrect password do not increment the counter. These are documented defaults, not a recommended custom threshold for every organization.
Customizing tenant-specific smart lockout settings requires Entra ID P1 or higher. Microsoft’s documentation excludes Microsoft Azure operated by 21Vianet from customization. In pass-through authentication deployments, Microsoft advises setting the Entra threshold below the on-premises Active Directory Domain Services (AD DS) threshold and the cloud lockout duration longer than the AD DS duration. This helps filter attempts in the cloud before they reach on-premises accounts. Coordinate the settings with normal user behavior and existing hybrid policies rather than blindly raising or lowering thresholds. See Microsoft’s smart lockout configuration details.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Require MFA and block weak or exposed password choices
Require multifactor authentication
Require MFA for users, with coverage appropriate to your tenant’s applications and access patterns. A guessed password alone should not be enough to authenticate. Treat unexpected MFA prompts as a signal to investigate: they may indicate that someone has a valid password and is attempting to complete sign-in.
Apply risk-based access controls where supported
Where licensing and policy design permit, use risk-based Conditional Access to require stronger authentication or a secure password reset when identity risk is detected. Microsoft Entra ID Protection provides risk information that can inform these requirements; available capabilities depend on licensing and configuration. Start with Microsoft’s Entra ID Protection overview.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Enable password protection
Microsoft Entra Password Protection can reject known weak passwords and organization-specific banned terms. It adds a layer against guessable credentials, but it does not replace MFA or monitoring. See Microsoft Entra Password Protection.
Detect activity across users, not just one account
Review Entra risk detections and sign-in logs, identity-provider logs for federated users, Microsoft Defender alerts, and SIEM correlations as your environment supports. Look for related attempts across multiple identities and compare:
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Source IP addresses and ASN, including whether several accounts share an unusual source.
- User agent, application, and authentication protocol.
- Timestamps, attempt frequency, and the sequence of successes and failures.
- MFA prompts users say they did not initiate, or a valid password followed by failed MFA.
Interpret a specific detection named password spray carefully. Microsoft says it means it observed a spray and successful credential validation against a user in your tenant; unsuccessful sprays do not produce that detection. Therefore, no such detection does not establish that no spray attempts occurred. A successful password followed by failed MFA is still an important investigation lead. Microsoft’s risk investigation guidance and password-spray alert classification provide more detail.
Free tools Windows power users keep installed
One-click scans. No signup required.
Respond to a suspected successful sign-in
- Validate the alert and sign-in. Compare the identity, source, application, protocol, timing, and related activity against what is legitimate for that user. Do not treat an unfamiliar IP address alone as proof of compromise.
- Contain confirmed unauthorized access. Follow your incident-response process: mark the sign-in as compromised, reset the affected password, and block the account if the attacker could otherwise retain access or reset credentials. Revoke tokens when indicated by the evidence and your response process.
- Check what the account could access. Determine whether the actor accessed mail or files, then inspect for persistence or tampering such as mailbox forwarding, inbox manipulation, or permission changes.
- Record legitimate explanations and tune carefully. If the activity is legitimate, document why and adjust policies or investigation rules without treating every unfamiliar network location as malicious.
Microsoft’s password spray investigation playbook and ID Protection investigation guidance describe response actions and risk review.
Quick Recap
Best Value
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Choose controls for your tenant’s authentication design
| Deployment choice | What to account for |
|---|---|
| Managed vs. federated authentication | Managed sign-in events are in Entra logs; federated failures may be held by the identity provider. Assign log review and response ownership accordingly. |
| Cloud-only vs. hybrid pass-through authentication | In pass-through deployments, coordinate Entra and AD DS lockout thresholds and durations so cloud controls filter attempts before they reach on-premises accounts. |
| Built-in vs. customized lockout | Defaults reduce setup effort; customization can fit local conditions but requires Entra ID P1 or higher. Balance attack resistance against normal user failures and avoid changing thresholds without checking hybrid policy. |
| Baseline MFA vs. risk-based Conditional Access | MFA provides a broad additional authentication requirement. Risk-based controls can trigger stronger authentication or secure reset based on detected risk, subject to licensing and policy setup. |
| Entra logs vs. central correlation | Entra logs provide sign-in context for applicable authentication paths. Federated logs and SIEM correlation can add context across systems, but require the relevant telemetry and operational setup. |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
