Microsoft is not fighting 7,000 human attackers every second. The figure describes an aggregate rate of more than 7,000 password-based attack attempts that Microsoft says it blocks or observes in its identity environment. Microsoft’s 2024 reporting also says password attacks made up more than 99% of the identity attacks in its telemetry—not of every attack on the internet. The defense is a layered identity system: Entra authentication, threat intelligence, machine-learning risk analysis, Conditional Access, stronger authentication, and automated detection and response.
What the 7,000-per-second figure actually means
The number is an attack-attempt rate, generally presented as an average or aggregate over a reporting period, not a live counter that proves exactly 7,000 events occurred in every second. It is also not a count of distinct people. One automated campaign can generate many attempts, often from distributed IP addresses and devices.
Microsoft’s 2024 Digital Defense Report describes password-based categories including breach replay, password spray and phishing. A related Microsoft report uses the wording “blocks more than 7,000 password attacks per second.” The defensible interpretation is therefore: Microsoft processes and rejects or identifies thousands of password-based attempts at scale within its observed identity environment.
The main password-attack methods
| Attack | What happens | Important defenses |
|---|---|---|
| Password spray | A few common passwords are tried across many accounts to avoid repeatedly triggering one account’s defenses. | Throttling, password protection, risk detection and MFA |
| Credential stuffing | Usernames and passwords exposed in another breach are replayed against Microsoft-hosted services. | MFA, leaked-credential detection and passwordless authentication |
| Phishing | A user is persuaded to enter a credential into a counterfeit sign-in page. | Passkeys or FIDO2, phishing-resistant MFA and user reporting |
| Brute force | Many guesses target one account or service. | Rate controls, risk policies and MFA |
| Breach replay | Previously stolen credentials are tested again, sometimes months or years later. | Compromised-password response and removal of reusable passwords |
Where Microsoft makes the decision
Microsoft Entra ID is the identity plane through which users, applications, devices and services authenticate to cloud and hybrid resources. A sign-in has to be evaluated before Entra issues an access token. That makes the authentication service the first enforcement point, rather than relying on an analyst to inspect each event manually.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Microsoft says Entra ID Protection uses machine learning and signals from across Microsoft Security to identify identity risk. Microsoft does not publish every model, threshold or signal weight, so the useful description is a system-level one: centralized authentication receives distributed telemetry, calculates risk automatically and applies policy at machine speed.
The sign-in pipeline
- Attempt: A user, application or device presents credentials or another authentication method.
- Validation: Entra checks the credential and the requested resource.
- Risk evaluation: The service compares the context with threat intelligence and prior behavior.
- Policy evaluation: Conditional Access selects an outcome.
- Enforcement and logging: Entra allows, challenges, remediates or blocks the request and records the decision for administrators and security operations.
How risk detection distinguishes normal from suspicious sign-ins
Microsoft distinguishes sign-in risk—whether this particular authentication looks suspicious—from user risk—whether the identity itself may be compromised. The two assessments can produce different responses.
Signals can include IP reputation, autonomous system and network characteristics, location, impossible or unusual travel, device identity and compliance, browser or user-agent changes, authentication velocity, known leaked credentials and behavior that differs from previous logins. Microsoft’s explanation of identity threat detection describes evaluating properties such as IP, ASN, location and user agent in the context of earlier sign-ins and threat signals. The service can also correlate activity involving users, devices, applications and identities.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
A risk score is not proof that a person is malicious. VPNs, mobile networks, traveling employees and shared infrastructure can look unusual. Administrators therefore need sensible exclusions, monitoring and emergency-access accounts rather than assuming every anomaly should be an immediate lockout.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteConditional Access turns risk into an action
Conditional Access is the policy layer that converts identity and device context into an access decision. Depending on tenant configuration, licensing and the application, a policy can:
- Allow access.
- Require MFA.
- Require a phishing-resistant method.
- Require a managed or compliant device.
- Require a password reset for a high-risk user.
- Block a high-risk sign-in.
Microsoft’s 2024 CISO guidance recommends blocking legacy authentication, requiring MFA, using phishing-resistant passwordless methods, restricting access to managed and compliant devices, and monitoring identity infrastructure. Those controls are not automatically equivalent in every subscription or tenant; organizations must configure and test them.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Why MFA makes a stolen password less useful
If an attacker guesses or steals a password, MFA requires another proof of identity before access is granted. Microsoft cites research estimating a 99.2% reduction in compromise risk when MFA is used. That is a Microsoft-attributed risk-reduction estimate, not a guarantee that an account cannot be compromised.
MFA methods are not equally resistant
| Method | What it improves | Remaining concern |
|---|---|---|
| SMS or voice | Stops password-only access for many attacks. | SIM swapping and interception. |
| Push approval | Convenient second factor. | MFA fatigue and social engineering. |
| TOTP code | Works without cellular service. | Adversary-in-the-middle phishing can capture the code. |
| Number matching | Reduces accidental push approvals. | It is not, by itself, phishing-resistant. |
| FIDO2 key or passkey | Uses a cryptographic credential bound to the legitimate service. | Enrollment, recovery, device compromise and legacy compatibility still require controls. |
Microsoft’s reporting specifically identifies SIM swapping, MFA fatigue and adversary-in-the-middle phishing as ways attackers can bypass or work around conventional MFA.
Why passkeys change the password attack surface
Passkeys and FIDO2 security keys use public-key cryptography. The private key stays on the user’s device or hardware key; the service stores the corresponding public key. During sign-in, the credential is scoped to the legitimate website or service origin. A counterfeit site therefore cannot normally obtain a reusable password or use the credential for the real site.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Windows Hello, platform credentials, Microsoft Authenticator passkeys and hardware security keys can have different enrollment, platform and legacy-application requirements. Passwordless authentication sharply reduces attacks that depend on reusable passwords, but it does not remove account recovery attacks, endpoint malware, stolen session cookies, malicious OAuth consent, rogue administrators or a compromised identity provider.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What happens after passwords stop working
Attackers move to the next trusted component when password guessing becomes unproductive. Microsoft’s 2024 executive summary describes several such paths:
- Adversary-in-the-middle phishing: A proxy relays a real login and attempts to capture the resulting session.
- Token and session theft: Malware or a compromised browser steals a token or cookie after authentication.
- MFA fatigue and SIM swapping: Social engineering targets the second factor or its recovery channel.
- Consent phishing: A user grants a malicious application access through OAuth permissions.
- Identity-infrastructure compromise: Federation servers, synchronization tools or on-premises Active Directory are attacked.
- Workload-identity abuse: Service principals and other non-human identities are given or obtain excessive permissions.
This is why “passwordless” should mean reduced dependence on passwords, not “attackless.” The device, token, recovery process, application permissions and infrastructure that issue trust still need protection.
Recommended Free Tools
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Identity threat detection and response
Identity threat detection and response (ITDR) treats identity telemetry as part of the security-operations picture. Entra signals can be correlated with endpoint, email, cloud and application activity through Microsoft Defender XDR. Microsoft describes scenarios in which suspicious identities, devices and applications are investigated together and remediation can be automated.
Possible responses include blocking a sign-in, requiring remediation, disabling or containing an account, investigating related devices and applications, and grouping activity into an incident. Automation is not necessarily enabled by default: licensing, permissions, tenant design and administrator choices determine what a customer actually receives. Automated account disablement also needs testing, because an overly aggressive rule can interrupt legitimate work or create a denial-of-service condition.
Security Copilot’s role
Security Copilot is an analyst-assistance layer, not the control that independently blocks every password attempt. Microsoft presents it as helping defenders summarize incidents, investigate alerts, query security data and generate response guidance. In an interview with VentureBeat, Microsoft Security executive Vasu Jakkal connected the scale problem with the need for defenders to work closer to machine speed.
Copilot cannot compensate for missing MFA, weak Conditional Access, inadequate logging or poor recovery procedures. High-impact actions still need suitable controls and human oversight.
Quick Recap
What organizations should deploy
Minimum baseline
- Enable MFA for every user.
- Block legacy authentication protocols.
- Require phishing-resistant MFA for administrators and other high-value accounts.
- Use risk-based Conditional Access where the tenant license supports it.
- Require managed or compliant devices for sensitive applications.
- Monitor risky users, risky sign-ins, authentication-method changes and privilege changes.
- Disable stale accounts and remove unused applications.
- Review OAuth consent and service-principal permissions.
- Protect synchronization, federation and other hybrid identity infrastructure.
- Document account recovery, emergency-access and incident-containment procedures.
Stronger target state
- Passkeys or FIDO2 keys for administrators and high-value users.
- Passwordless authentication for ordinary users as applications support it.
- Conditional Access based on sign-in risk, device compliance, application sensitivity and administrative role.
- Privileged Identity Management and just-in-time administration.
- Continuous monitoring for token, session and consent anomalies.
- Correlated identity and endpoint telemetry in the SOC.
- Tested recovery plans for Entra ID, Active Directory, federation, synchronization and emergency accounts.
Where the architecture can fail
- Risk policy friction: Aggressive blocking can affect travelers, VPN users, contractors and mobile workers.
- Hybrid exposure: A secure cloud tenant can still be undermined by a compromised domain controller, federation server or synchronization path.
- Recovery weakness: A stolen phone, help-desk social-engineering attack or SIM swap can defeat an otherwise strong enrollment.
- Endpoint compromise: Malware can attack an authenticated session even when the initial login used a passkey.
- Excessive automation: A bad rule—or a compromised automation account—can make damaging changes at machine speed.
- Licensing and configuration: Entra ID P1 and P2 expose different capabilities; risk detection, Privileged Identity Management and related controls are not universal defaults.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
