[cratermoon]

If I'm reading this correctly, the error response back to the client is a problem. The plain text is a generic "invalid username or password", but the error code included reveals too much. One of:

- The user does not exist

- The user exists and the correct username and password were entered, but the account is locked

- The user exists but does not have a password in Azure AD

- The user exists, but the wrong password was entered

- The user exists, but the maximum Pass-through Authentication time was exceeded

This violates a cardinal rule of authentication. A malicious actor can know from the error code if the user they are attempting to break is exists or not (that reduces the search space by quite a lot) and worse, it even tells them when they have a correct username/password combo for a locked account.

Yes, attempts can be throttled, but once the attacker knows a valid username/password, they can just wait.