Azure KQL AAD

SigninLogs | where ResultType == "50126"

Search SigninLogs for failed Azure AD sign-ins (ResultType 50126) to detect password sprays and brute force against the tenant.

Run it when you want the tenant's authentication view: ResultType 50126 (incorrect credentials) in SigninLogs is the cloud equivalent of 4625 — and grouped by IP or user reveals sprays against Azure AD, the most common initial access vector against the cloud. The base query filters failures; extended with summarize by IPAddress or UserPrincipalName, it gives you the pattern: one IP hammering many accounts is a spray, one account with many failures from one IP is targeted brute force. It's the first query in identity hunting in Sentinel, and the basis for Microsoft's spray rules.

Don't use it as the only source of logons: SigninLogs only covers Azure AD — logons to on-prem resources live in SecurityEvent (068). The result field (ResultType 50126) distinguishes credential failure from other failures (account locked 50057, MFA 500121): filter by the correct code or you'll mix in noise. And watch out: the volume of SigninLogs in large tenants is huge and the cost of the query without a time window is high — scope with TimeGenerated. Sprays against accounts without MFA or with MFA fatigue (the attacker insists until the user accepts) don't always leave the failure pattern: complement with 50125/500121 and with subsequent successful logons.