Brute force tries many passwords against one account (and trips lockouts). Password spraying does the opposite: one common password (Winter2026!) against many accounts, slowly, so no single account locks out.
Why it evades simple detections
A per-account "5 failures = alert" rule never fires - each account sees only one or two attempts. The signal isn't per-account; it's the pattern across the tenant: one source, one password, many usernames, spread over time.
What to detect
- Many distinct accounts failing from one source IP/ASN in a window.
- A high ratio of failed logons across the org with the same failure reason.
- A burst of 4625 (Windows) or Azure AD/M365 sign-in failures to many users, then a single success.
- Auth from anonymizing infrastructure (VPN/Tor/cloud) against many identities.
Respond + prevent
- On a confirmed spray, reset the compromised account(s) and hunt for what the successful logon did.
- MFA blunts spraying massively (a valid password isn't enough).
- Smart lockout / risk-based auth (like Azure AD) throttles by source, not just per-account.
- Ban common/breached passwords so
Season2026!isn't valid in the first place.