Microsoft says 22% of Azure Active Directory customers used multi-factor authentication on their accounts in 2021, and it blocked 25.6B brute force attacks
Catalin Cimpanu / The Record :
Context & Ripple Effects
Microsoft's 2021 Azure Active Directory numbers land in the middle of a year in which it was loudly staking its identity business as a differentiator: it had already claimed the DDoS mitigation record with a 2.4Tbps attack blocked in August, surpassing AWS' 2.3Tbps mark, and it has been pushing passwordless sign-in since adding Authenticator-based passwordless logins for Azure AD-connected apps in 2018. The 22% MFA adoption figure is the uncomfortable counterpoint — the platform absorbing 25.6 billion brute-force attempts is still mostly protecting accounts that rely on passwords alone.
First-order effects
- Roughly four in five Azure Active Directory customers ended 2021 without multi-factor authentication, meaning the 25.6 billion blocked brute-force attacks were aimed overwhelmingly at single-factor accounts.
Second-order effects
- Identity competitors such as Okta and Google face pressure to publish comparable adoption and attack-volume telemetry, turning security statistics into a marketing battleground for enterprise directory customers.
Third-order effects
- Microsoft's later disclosure of a [[a:980753|phishing campaign that hijacked Office 365 authentication even on MFA-protected accounts at 10K+ organizations]] shows where this leads: passwordless and phishing-resistant methods become the next mandatory baseline, and identity providers — not firewalls — become the de facto security perimeter enterprises buy.
The trend: Cloud identity providers are publishing their own attack telemetry to push customers toward MFA and passwordless authentication, making the directory itself the primary security control enterprises rely on.