Smart Lockout & Password-spray Indicators

The question it answers: Which IP addresses sprayed wrong passwords at many accounts, and which users were locked out by smart lockout in the last 7 days?

Password spray tries a few common passwords against many accounts from the same address; smart lockout is Entra’s brake on it. An IP with wrong passwords for many different accounts is a spray source to block; users locked out from several IPs are being targeted.

Note

Spray: an IP with wrong-password errors (50126) for at least 5 distinct accounts. Lockout: error 50053. Identity Protection’s own ‘password spray’ detection (Risky Users report) needs P2.

At a glance

Where in the app	Entra ID › Sign-in Analytics › Lockouts & Password Spray
Workload	Entra ID
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Entra ID P1.
Report id (API and MCP)	entra.sign-ins.lockouts-and-spray

Columns

Column	Key	Type
IP / user	Name	Link
Type	Category	Status
Finding	Finding	Text
Accounts	DistinctUsers	Text
Events	Count	Text
Targets / source	Detail	Text
Country / UPN	Secondary	Text
Last seen	LastSeen	DateTime

What it needs

Licence: Microsoft Entra ID P1.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
AuditLog.Read.All	Microsoft Graph	Read all audit log data

Data sources it reads

• GET /beta/auditLogs/signIns (7 days)

Through the API and MCP

GET /ir-api/v1/reports/entra.sign-ins.lockouts-and-spray?size=100

An AI assistant reads it with the MCP tool get_report and the id entra.sign-ins.lockouts-and-spray. The client needs the Read grant for Entra ID. See Using the API.