Password in the cloud

harsh waghela 0

i have observed multiple sign ins from dublin location with the IP being microsoft , and the user agent is Rich client , further the auth method is Password in the cloud, also we have observedToken Protection - Sign In Session StatusCode is the same for all logins , no unsual signins are observed what can be the scenario ?

ZhoumingDuan-MSFT 14,870 Reputation points Microsoft Vendor

2025-01-03T01:39:21.3933333+00:00

@harsh waghela, Thanks for posting in Q&A.

Since the issue is complicated, and there is not much useful information I can find, it is suggested that you contact Microsoft Entra ID support to get more help.

https://learn.microsoft.com/en-us/entra/fundamentals/how-to-get-support

Also, I will add Microsoft Entra ID tag, you can wait to see if there will be Microsoft Entra ID support to help.

Thanks for your time and understanding.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Goutam Pratti 1,310 Reputation points Microsoft Vendor

2025-01-06T22:48:29.62+00:00

Hello @harsh waghela ,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Goutam Pratti 1,310 Reputation points Microsoft Vendor

2025-01-07T19:55:49.3366667+00:00

Hello @harsh waghela ,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

1 answer

Goutam Pratti 1,310 Reputation points Microsoft Vendor

2025-01-03T06:47:28.0866667+00:00

Hello @harsh waghela ,

Thank you for reaching out Microsoft Q&A.

This is common behavior where a rich client is used as a browser for application sign-ins. Regarding your mention of "Password in the cloud," this occurs when a user enters their password while logging into the application, indicating a user-interactive sign-in.

For Token Protection and the Sign-In Session Status Code, you will observe the same code because the sign-in was initiated from the same network without any activity of a man-in-the-middle attack. A rich client can also act as a device browser for first-party applications, primarily during non-interactive sign-ins.

I recommend reviewing the user's sign-ins to check for any unusual activity. If everything appears normal except for the device browser behavior, you can safely ignore it. Attaching screenshot from my test tenant for reference.

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Thanks,
Goutam Pratti.
Please sign in to rate this answer.
Goutam Pratti 1,310 Reputation points Microsoft Vendor

2025-01-09T18:53:54.03+00:00

Hello @harsh waghela ,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Goutam Pratti 1,310 Reputation points Microsoft Vendor

2025-01-10T22:14:56.16+00:00

Hello @harsh waghela ,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Password in the cloud

1 answer

Your answer