If you run Microsoft 365 for your small business or as a freelancer, a recent credential-stuffing campaign shows that MFA alone isn’t enough when policies aren’t tight enough. The report describes a wave of login attempts against Microsoft 365 accounts, with tens of millions of tries and some MFA bypasses tied to how accounts and access policies were configured. The takeaway: strengthen authentication controls beyond a basic MFA prompt.
What happened
Security researchers reported a large credential-stuffing campaign targeting Microsoft 365 accounts. Attackers used stolen credentials from prior breaches and automated login attempts at scale. In some cases, MFA was bypassed due to misconfigurations in Conditional Access policies and the particular authentication flows in use. The campaign underscores how attackers can leverage existing credentials even when MFA is in place, if the surrounding access controls aren’t set up to resist such abuse. For context, analyses highlight that there were tens of millions of login attempts in a short window, illustrating the scale of modern credential-stuffing efforts. Read more from the threat research overview.
Why it matters
Why this matters to different readers:
- Small business owners: If your team signs into a Microsoft 365 tenant, a single misconfigured policy can let attackers test and potentially compromise accounts—even with MFA enabled.
- Freelancers and creators: You’re often juggling multiple client services. A credential-stuffing hit on one service can threaten access to others if you reuse credentials or don’t enforce strong auth everywhere.
- IT-minded readers: This highlights gaps in Conditional Access, legacy authentication, and the need for phishing-resistant MFA as a baseline, not an afterthought.
Practical steps you can take
Below are concrete actions you can test in under 15 minutes, with a focus on pairing each risk with a defense.
- Turn on MFA for all users (including non-admins) in Microsoft 365 admin center. In the Microsoft 365 admin center, go to Users > Active users, select users, and enable multi-factor authentication. This reduces the chance that stolen credentials work without the second factor.
- Enable phishing-resistant MFA where possible. If your identity provider supports WebAuthn/FIDO2 passkeys, enroll high-risk accounts (especially admins and finance) with phishing-resistant MFA to block credential-stuffing that relies on weaker factors.
- Tighten Conditional Access policies. In Azure Active Directory / Entra ID, review and tighten Conditional Access policies to require MFA for all access to Exchange Online, SharePoint, and Teams, not just some apps. Ensure policy assignments aren’t inadvertently skipped for trusted locations.
- Disable legacy authentication (basic/IMAP/POP/SMTP) where you can. In the Exchange Online or Microsoft 365 security settings, disable Basic Authentication and legacy protocols to prevent attackers from using older login paths that bypass modern controls.
- Block or slow down repeated login attempts. Enable rate limiting and bot protection at the login surface, and monitor for unusual sign-in patterns (geography, device, or time).
- Review admin account protections. Ensure admin accounts require MFA, use phishing-resistant methods if available, and consider additional controls like just-in-time access and device-based risk checks.
- Set up rapid breach monitoring for credentials. Regularly check for breached credentials related to your domain on Have I Been Pwned or your chosen breach-monitoring tool, and enforce a password-change policy if you discover exposure.
If you’d like a quick read on how researchers see these campaigns, this overview from a threat research center covers the scope and response recommendations: Massive Credential-Stuffing Attack Targets Microsoft 365 Accounts With 81 Million Login Attempts (2026).
Final thought
Passwords aren’t enough on their own, and MFA isn’t a silver bullet if policy configurations lag. Start today by forcing MFA for all users, adopting phishing-resistant options where possible, and tightening access controls around admin and high-risk accounts. Small steps now can meaningfully reduce the risk of credential-stuffing leaking into your business identity.