PowerShell guide for auditing Entra ID login logs and detecting password sprays

Fri, 21 Aug 2026 11:38:25 +0000

Engineer — Learn: Practical reminder that cloud identity login logs (Entra ID sign-in logs) deserve the same daily scrutiny as on-prem logs; useful if you haven’t wired these into a monitoring workflow yet, but no patch or config change required.
SOC/IR — Plan: Adopt or adapt the PowerShell queries shown to pull Entra successful/failed login data for routine password-spray hunting; worth scheduling as a log-source coverage improvement if Entra sign-in logs aren’t already feeding your SIEM.
Leader — Skip

Password-Spray on CuraSec