Created by Claude - please verify

Lockouts and spray - thresholds are simple counts over 7 days; shared egress IPs (proxies, VPNs) can trigger the spray rule.

Required Microsoft Graph permissions

AuditLog.Read.All — application permission, granted to the app registration with admin consent.

Licence: Microsoft Entra ID P1.

Endpoint: GET /beta/auditLogs/signIns (7 days)

Spray: an IP with wrong-password errors (50126) for at least 5 distinct accounts. Lockout: error 50053. Identity Protection's own 'password spray' detection (Risky Users report) needs P2.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Smart Lockout & Password-spray Indicators

Password spray tries a few common passwords against many accounts from the same address; smart lockout is Entra's brake on it. An IP with wrong passwords for many different accounts is a spray source to block; users locked out from several IPs are being targeted.

No spray pattern and no smart-lockout events in the last 7 days.