Alex Weinert
- Published 'Your Pa$$word doesn't matter', reframing password policy around MFA
- Drove Microsoft's published account-compromise telemetry into public guidance
- Led identity security and protection for Microsoft's identity platform
Bio
Alex Weinert leads identity security work at Microsoft and is the author of a run of posts that changed how the industry talks about passwords, most famously "Your Pa$$word doesn't matter," which argued from Microsoft's own attack telemetry that composition rules and rotation policies barely move the outcome while multi-factor authentication does.
Profile built from public employer publications and press records.
Where their work shows up
The argument landed because of the data behind it: Microsoft sees attack traffic at a volume almost nobody else can observe, and publishing what actually compromises accounts made the case that a security team could take to its own leadership. It is a large part of why complexity rules and forced rotation fell out of favour, and why MFA and then phishing-resistant methods became the default recommendation. See password spraying, MFA fatigue, and what is passwordless.
Related on Start with Identity
- Blog46.5% of 2025-2026 identity breaches had no login for MFA to protect
SWI's Identity Breach Report 2026 classified 115 identity breaches from 2021 to October 2026. Where MFA status is known it was bypassed in 25 of 40 cases, and i
- GlossaryAccount Recovery
The process by which a user regains access after losing their authenticator: a lost device, a forgotten password, or a revoked credential. It is a parallel auth
- GlossaryAuthenticator Assurance Level (AAL)
NIST 800-63B levels describing authentication strength. AAL1: single factor. AAL2: multi-factor. AAL3: multi-factor with phishing-resistant cryptographic authen
- GlossaryCIBA
Client-Initiated Backchannel Authentication. An OpenID Connect flow where authentication is initiated on one device and approved on another, useful for call cen
- BlogEntra ID stops delivering SMS and voice codes on February 1, and global admins go last
From February 1, 2027, Microsoft stops providing SMS and voice authentication in Entra ID, and users with no other method must register a passkey to keep signin
- ReportIdentity Breach Report 2026: how attackers get in
115 identity breaches, 2021 to 2026: MFA was bypassed in 25 of the 40 with a known MFA status, and 46.5% of 2025-2026 cases had no login for MFA to protect.