From Error to Entry: Cracking the Code of Password-Spraying Tools

This blog post describes how the author discovered during an engagement that the AADSTS50079 error returned by Microsoft Entra (Azure AD) indicates a user must complete MFA enrollment, not merely that MFA is enabled; attackers (or testers) can exploit this behavior during password-spraying to onboard MFA and gain access. The post compares how popular Office 365 password-spraying tools handle AADSTS error codes, demonstrates the security impact of misinterpreting AADSTS50079, and lists pull requests submitted to tooling to correct the handling of these error codes.