According to Microsoft’s statistics, users who use multi-factor authentication for their accounts are far better protected than those who don’t. The company claims that multi-factor authentication lets you block 99.9% of automated attacks. This doesn’t only apply to Microsoft accounts, but also to any other profile, website, or online service.
The company’s blog therefore states that more than 300 million fraudulent sign-in attempts to Microsoft’s cloud services are made every day. Enabling multi-factor authentication blocks 99.9% of these attempts, even when attackers have a copy of the user’s current password.
The remaining 0.1% involve more complex attacks that rely on capturing multi-factor authentication tokens, but such attacks are still very rare compared to credential stuffing attacks carried out by botnets.
Microsoft’s engineers also write that user passwords, or their complexity, no longer matter. Today, hackers have a variety of methods for obtaining a user’s credentials. In most cases, the password itself is simply irrelevant.
Therefore, if the provider supports multi-factor authentication, Microsoft strongly recommends using it, whether that means one-time passwords sent by SMS or more advanced biometric solutions.
