A spray over IMAP that skipped MFA
Spot a password spray against Exchange Online over IMAP in Entra sign-in logs, find the account that worked, and read why conditional access never asked it for MFA.
Briefing
Legacy protocols such as IMAP, POP, and SMTP AUTH send a username and password and cannot do MFA. Conditional access applies to them only if a policy targets “other clients”.
Error 50126 is a bad username or password. conditionalAccessStatus notApplied means no policy matched the sign-in.
cloud-shell · Cloud logs
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.