Kicking it Old-School with Time-Based Enumeration in Azure

This report demonstrates a time-based user-enumeration technique against Microsoft 365 Autodiscover (autodiscover-s.outlook.com) by measuring response-time differences between valid and invalid usernames when Basic Authentication is encountered. It details a Python scanner (Autodiscover Enumerator), a reclassification/parser (reclassify.py) using Jenks natural breaks to determine thresholds across different thread counts, test results showing distinct timing clusters for valid UPNs and aliases, and caveats including network variability, inability to identify valid credentials, and guidance for tuning timeouts.