Microsoft's telemetry shows that organisations with Conditional Access properly deployed are dramatically less likely to suffer account compromise. Here's the data and what the policies actually do.
Key takeaways
- 1MFA alone blocks more than 99.9% of account compromise attacks
- 2Blocking legacy authentication blocks another large category of attacks that bypass MFA entirely
- 3Identity Protection risk-based policies automatically remediate the majority of anomalous sign-ins without requiring manual analyst response
- 4Organisations with Conditional Access deployed are significantly less likely to appear in Microsoft's incident response caseload
Microsoft processes more than 30 billion authentication events every day across its identity platform. The scale of this data gives Microsoft a unique view of attack patterns, and the numbers behind Conditional Access effectiveness are striking.
What the data shows
- MFA alone blocks more than 99.9% of account compromise attacks
- Blocking legacy authentication blocks another large category of attacks that bypass MFA entirely
- Identity Protection risk-based policies automatically remediate the majority of anomalous sign-ins without requiring manual analyst response
- Organisations with Conditional Access deployed are significantly less likely to appear in Microsoft's incident response caseload
The attack patterns Conditional Access stops
- Credential stuffing — username and password combinations from breach databases tried automatically. MFA stops this cold.
- Password spray — one common password tried against thousands of accounts. MFA stops successful authentication even when the password is correct.
- Impossible travel attacks — stolen credentials used from overseas. Named location and travel anomaly policies block these automatically.
- Legacy protocol attacks — IMAP, POP, and basic auth bypass modern authentication. Blocking legacy auth eliminates this vector.
- Unmanaged device access — company data accessed from an unknown device that could be malware-infected. Device compliance requirements block non-enrolled devices.
The gap in most tenants
The tragic part is that most of this protection is already included in Business Premium — it just needs to be configured. An organisation paying $42/user/month for Business Premium but not deploying Conditional Access is spending the same amount as an organisation that is fully protected, and getting a fraction of the protection. The MSP's job is to close that gap.
