MFA blocks 99.9 percent of attacks: what the claim does and does not mean

A 2019 Microsoft blog post claimed that multi-factor authentication can block over 99.9 percent of account compromise attacks. The post gives no study or method for the figure, so treat it as a persuasive estimate, not a measured guarantee. MFA is still among the best returns on security spend.

What the post says

The post's bolded claim is that MFA can block over 99.9 percent of account compromise attacks, and its infographic repeats the figure. The text says that with MFA, knowing or cracking the password will not be enough to get in.

The page shows no dataset or methodology behind the number. It is dated August 2019 and written by a Microsoft product marketing manager, and it promotes Microsoft's passwordless offerings. That does not make it wrong, but it means you should not quote it as a research result.

The caveats on the page

The post itself lists conditions:

• Applications that use basic protocols such as SMTP were not designed to handle MFA, so attackers may steer toward legacy protocols.
• MFA is not offered as a standalone fix. The post also lists banning weak passwords, blocking legacy authentication and phishing training.
• The protection applies only where MFA is actually enforced.

Where the number can mislead

• Not all MFA is equal. A code that can be relayed through a fake login page is weaker than a security key. See AiTM phishing.
• Fatigue attacks exist. Repeated push prompts can wear a user down. See MFA push fatigue and number matching.
• Coverage gaps. An unprotected service account or legacy mailbox is the way around.
• Recovery paths. A weak reset flow undoes strong sign in. See MFA recovery codes.

The economic view

For a defender the sensible reading is about cost per unit of risk removed. Enabling MFA across accounts is cheap compared with most controls, and it removes a common route: stolen or guessed passwords. Even if the real figure is lower than 99.9 percent, the case remains.

The upgrade path is also cheap to rank. Start with admin and remote access accounts, then email and code hosting, then everyone. See phishing resistant MFA rollout order and which MFA to require.

How to talk about it

Say that MFA blocks the large majority of password based attacks when enforced everywhere and combined with good recovery and legacy protocol controls. Do not say it blocks 99.9 percent unless you cite the source and its limits.

Quick check

Sources

• Microsoft, One simple action you can take to prevent 99.9 percent of account attacks

Last reviewed: 19 October 2026.