# Microsoft: 97% of identity attacks are password attacks

Source: https://startwithidentity.com/blog/2026-01-20-microsoft-reports-identity-attacks-dominated-by-password-attacks/
Last updated: 2026-07-27
License: content by Start with Identity. Cite the source URL.

---

Microsoft's Digital Defense Report, covering July 2024 to June 2025, puts the scale of identity attacks at roughly 600 million per day across Entra. Of those, 97% are password attacks, overwhelmingly [password spray](https://startwithidentity.com/glossary/password-spraying/). Identity-based attacks rose 32% in the first half of 2025 alone.

Password spray works differently from the credential stuffing it is often confused with. Rather than trying many passwords against one account, which triggers lockout, it tries one common password against thousands of accounts, staying under per-account thresholds while succeeding somewhere. That is why it survives lockout policies and why it scales.

The figure Microsoft pairs with all of this: phishing-resistant MFA stops over 99% of these attacks even when the attacker already holds a valid username and password.

## Why it matters

Those two numbers together are the clearest argument for [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/) available, and they are worth reading precisely. Attackers are not mostly doing anything clever. They are spraying common passwords at scale, because it still works often enough to be the rational choice.

Two cautions on citing this. The 99% figure describes the attacks in that 97% bucket, not every threat: it says nothing about [token theft](https://startwithidentity.com/glossary/token-theft/) or consent phishing, which run after authentication and are unaffected by how strong the authenticator was. And the sophisticated end of the market has already moved, which is why the same period produced [OAuth device-code kits](https://startwithidentity.com/blog/2026-07-14-new-phishing-kits-target-microsoft-365-accounts-evade-mfa/) and vishing campaigns aimed at enrollment rather than sign-in.

The honest reading is that phishing-resistant MFA closes the enormous, unglamorous majority of attacks and pushes the remainder toward sessions, enrollment, and consent. That is a very good trade, and it is not the end of the work. Our [MFA rollout guide](https://startwithidentity.com/guides/authentication/mfa-rollout/) covers the sequencing.

Source: [Microsoft Digital Defense Report](https://www.microsoft.com/en-us/corporate-responsibility/topics/cybersecurity/reports/microsoft-digital-defense-report/)