Microsoft stopped trusting passwords on its own front door before it ever asked you to.
Since October 2024, nobody can sign in to the Azure, Entra or Intune admin centers without multifactor authentication. The Microsoft 365 admin center followed in February 2025, and in October 2025 it extended to PowerShell and the command-line tools. That includes the emergency "break glass" accounts most firms keep in reserve.
Microsoft's own 2023 research explains why. Across its commercial accounts, MFA cut the risk of account compromise by 99.22%. Even when the password had already leaked, it still stopped 98.56% of attempts.
Here is what the other side looks like at a 15-attorney firm. A paralegal reuses a password that turns up in a breach dump somewhere else. Someone signs in to her mailbox at 2am, reads quietly for three weeks, waits for a closing, then emails updated wire instructions from her real address. No malware. No alarm. Just a password that worked.
The cleanup is not a technical problem. It is days of lost billable hours, a conversation with a client you cannot take back, and an insurance renewal where "how do you authenticate users?" is now the first question on the form.
Most firms have MFA on email. Far fewer have it on every admin account, VPN and remote desktop. Worth a look before your next renewal.
Want the next one in your inbox?
One practical Microsoft 365, Copilot, Azure, or security move per week — plain English, no pitch.
Subscribe via email