A legacy Entra ID WS-Trust autologon endpoint used for Seamless SSO can be abused to spray passwords past Smart Lockout, bypass normal sign-in logging, and reveal whether credentials are valid even when MFA or Conditional Access blocks the final sign-in. Microsoft has left this path available for older Office 2013 clients, but the result is a quieter and more informative attack surface that defenders can close by disabling legacy auth, enforcing Conditional Access, or moving to passwordless sign-in. #EntraID #WS-Trust #SeamlessSSO #SmartLockout #AADSTS50055 #AADSTS50076 #AADSTS53003 #Office2013
Keypoints
- Microsoft’s Smart Lockout was designed to stop repeated password attempts in Entra ID, but the legacy WS-Trust autologon endpoint does not behave like modern interactive sign-in paths.
- The endpoint at autologon.microsoftazuread-sso.com/{tenant}/winauth/trust/2005/usernamemixed can be reached directly from the internet and accepts username/password authentication in a SOAP request.
- Responses from this endpoint leak useful account-state information through AADSTS codes, allowing attackers to distinguish a wrong password from a valid password blocked by MFA or Conditional Access.
- Testing showed more than 1,000 failed attempts against a single account without triggering the expected lockout response, and failed attempts stayed out of standard Entra ID sign-in logs.
- The attack chain includes user enumeration, filtering real accounts, spraying a chosen password, triaging AADSTS responses, and then using valid credentials for follow-on access.
- Even MFA-protected accounts are valuable to attackers because a confirmed password can support phishing, device code abuse, token theft, and password reuse attacks.
- Defensive fixes include disabling the usernamemixed endpoint, blocking legacy authentication with Conditional Access, monitoring the Unified Audit Log, and moving to passwordless methods like FIDO2 and Windows Hello.
MITRE Techniques
- [T1110.003] Password Spraying – The attacker tests one common password across many accounts to find valid credentials without triggering expected controls. [‘Pick one common password or a company-themed guess and send it against every account in the filtered list.’]
- [T1589.001] Gather Credentials – The attack relies on submitting usernames and passwords to the legacy endpoint to validate whether credentials are correct. [‘A request can send a username and password in a SOAP envelope, and the endpoint will return a structured response describing what happened.’]
- [T1087.003] Email Account Discovery – The attacker enumerates which email addresses belong to real users before spraying passwords. [‘The IfExistsResult field reveals whether the user exists, with 0 meaning the user exists and 1 meaning the user was not found.’]
- [T1557.002] Adversary-in-the-Middle – Confirmed credentials for MFA-protected accounts can be used in downstream phishing workflows to bypass MFA. [‘For MFA_REQUIRED accounts, downstream techniques such as adversary-in-the-middle phishing… can bypass the MFA requirement and complete the sign-in.’]
- [T1098.001] Additional Cloud Credentials – The discussion describes stealing primary refresh tokens after confirming valid credentials to gain access. [‘…device code flow abuse, or primary refresh token theft.’]
- [T1078.004] Cloud Accounts – Valid credentials against Entra ID accounts are used for direct access through Microsoft cloud services. [‘For VALID accounts without MFA, the attacker has direct access through OAuth2 or Microsoft Graph.’]
- [T1110.004] Credential Stuffing – The article notes password reuse attacks against other systems as a follow-on use of confirmed passwords. [‘…password reuse attacks against other systems…’]
Indicators of Compromise
- [Domain/URL] Legacy Entra ID WS-Trust autologon endpoint used for Seamless SSO – autologon.microsoftazuread-sso.com, https://autologon.microsoftazuread-sso.com/{tenant}/winauth/trust/2005/usernamemixed
- [AADSTS error codes] Authentication outcomes that reveal account state and password validity – AADSTS50034, AADSTS50053, and 2 more codes
- [Microsoft API field names] User-enumeration and account-existence checks in Microsoft 365 / Entra ID – IfExistsResult, UsernameToken
- [Protocols / authentication paths] Legacy authentication and federation-related traffic observed in the attack path – WS-Trust, SOAP
- [Client/software references] Legacy client dependency that motivates the endpoint’s existence – Office 2013, Entra Seamless SSO
Read more: https://www.varonis.com/blog/ws-trust-autologon-endpoint