New Azure Active Directory password brute-forcing flaw has no fix

Has no fix? You don't need logging, you just need to keep track of fails and start throttling attempts.