> For the complete documentation index, see [llms.txt](https://notes.incendium.rocks/pentesting-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.incendium.rocks/pentesting-notes/cloud/azure/service-discovery-recon-enumeration-and-initial-access-attacks/password-spraying.md).

# Password Spraying

**Not a great attack method against cloud infrastructure, but it is possible.**

Use a single password against multiple users that were enumerated. For Azure, password spray attacks can be done against different API endpoints.

#### MSOLSpray

```powershell
Invoke-MSOLSpray -UserList validemails.txt -Password Password123! -Verbose
```

{% hint style="danger" %}
This is noisy and may lead to detection
{% endhint %}