Alex Weinert
- Published 'Your Pa$$word doesn't matter', reframing password policy around MFA
- Drove Microsoft's published account-compromise telemetry into public guidance
- Led identity security and protection for Microsoft's identity platform
Bio
Alex Weinert leads identity security work at Microsoft and is the author of a run of posts that changed how the industry talks about passwords, most famously "Your Pa$$word doesn't matter," which argued from Microsoft's own attack telemetry that composition rules and rotation policies barely move the outcome while multi-factor authentication does.
Profile built from public employer publications and press records.
Where their work shows up
The argument landed because of the data behind it: Microsoft sees attack traffic at a volume almost nobody else can observe, and publishing what actually compromises accounts made the case that a security team could take to its own leadership. It is a large part of why complexity rules and forced rotation fell out of favour, and why MFA and then phishing-resistant methods became the default recommendation. See password spraying, MFA fatigue, and what is passwordless.
Related on Start with Identity
- GlossaryAccount Recovery
The process by which a user regains access after losing their authenticator: a lost device, a forgotten password, or a revoked credential. It is a parallel auth
- GlossaryAuthenticator Assurance Level (AAL)
NIST 800-63B levels describing authentication strength. AAL1: single factor. AAL2: multi-factor. AAL3: multi-factor with phishing-resistant cryptographic authen
- GlossaryCIBA
Client-Initiated Backchannel Authentication. An OpenID Connect flow where authentication is initiated on one device and approved on another, useful for call cen
- BlogEntra ID stops delivering SMS and voice codes on February 1, and global admins go last
From February 1, 2027, Microsoft stops providing SMS and voice authentication in Entra ID, and users with no other method must register a passkey to keep signin
- CVEOkta Verify for Windows local privilege escalation
Okta Verify on Windows could be turned into a local privilege escalation. The MFA app on the endpoint is part of the identity plane. Pair with Okta's 2024 FastP
- BlogThe SMS off-ramp has a date now: what Entra, GOV.UK and America.gov mean for your MFA plan
Microsoft stops delivering SMS and voice codes in Entra ID on February 1, 2027. The UK has put passkeys in front of 23 million citizens, and the new federal fro