An AI Bot Is Attacking Your Login

Frequently asked questions

Why doesn't watching your logs defend against an automated attacker?

An automated attacker doesn't sleep, and volume is the whole point — it changes the maths, not just the scale, so a human reviewing logs after the fact is always behind. The defence has to be automatic too.

What actually stops a credential-stuffing bot?

Three controls at the API itself, not the UI: rate limiting takes away its speed, smart lockout plus MFA makes a correct guess useless, and a service like Defender for Cloud watches continuously. A CAPTCHA on a web form does nothing if the bot is calling the API directly.

Read deeper on Azure

Twenty seconds gets the shape of an idea across. These go into how it behaves in production.

• How Azure Protects a Mobile App: The Full Request Flow, Layer by Layer

  Front Door, your API, Microsoft Entra ID, authorization and a private database — the five layers that stand between a mobile app and its data on Azure.

• Your Mobile App Is Leaking Its API Key — and Obfuscation Will Not Save It

  An APK or IPA is a zip file. Anything hardcoded inside it, including your API key, is already public — and here is how to get it off the phone for good.

• What Is Microsoft Foundry (Azure AI Foundry)? The Services, and When You Actually Need Them

  A plain tour of Microsoft Foundry for developers: the resource, projects, models, agents, tools, and when Azure OpenAI on its own is enough.