WS-Trust Autologon Endpoint: Password Spray Without Smart Lockout Blocking
Varonis, Wednesday, August 12th, 2026
Varonis details a legacy Entra ID WS-Trust endpoint that lets attackers password spray past Smart Lockout.
Varonis published research on a legacy Entra ID WS-Trust Autologon endpoint, kept alive for Office 2013 clients, that undermines Smart Lockout protection.
The endpoint lets attackers spray passwords without triggering Smart Lockout and confirm valid credentials even on MFA-protected accounts.
It also leaves only partial logs behind, complicating detection. Varonis traces the issue back to changes made in 2018. The post sets out how organisations can mitigate the exposure.