Act’s September 2026 Microsoft 365 security survey, reported by TechTarget Japan on October 29, found that 89.8% of companies reporting incidents or suspected incidents had MFA in place. The survey also reported two affected-account categories: MFA temporarily disabled or excluded in 43.0% of cases, and authentication-method or configuration problems in 21.4%. Together, those categories total 64.4%.
On this page
- What Act’s survey reported
- Where regular security reviews lag
- How an account can be compromised after MFA
- What a response covers beyond a password reset
What Act’s survey reported
Act surveyed 1,002 people involved in Microsoft 365 operations at private companies with 100 to 999 employees. The incident period covered September 2025 through September 2026. TechTarget Japan reported that 71.5% of surveyed companies had experienced unauthorized access, account compromise, or suspicion of either during that period.
| Survey measure | Reported result | Population or measure | Period |
| Companies reporting unauthorized access, compromise, or suspicion | 71.5% | Surveyed companies | September 2025 to September 2026 |
| MFA applied | 89.8% | Companies reporting incidents or suspected incidents | Survey conducted September 2026 |
| MFA temporarily disabled or excluded | 43.0% | Affected or suspected-affected accounts | Survey conducted September 2026 |
| Authentication-method or configuration problems | 21.4% | Affected or suspected-affected accounts | Survey conducted September 2026 |
| Combined total of the two affected-account categories | 64.4% | 43.0% plus 21.4% | Survey conducted September 2026 |
The company-level MFA figure and the affected-account figures describe different units. A company can have MFA deployed while an individual account is excluded, temporarily exempted, or affected by a problem with its authentication method or settings.
Where regular security reviews lag
TechTarget Japan also reported that 82.6% had used security recommendations to inspect settings, while 67.1% expressed confidence in their settings. Just 32.7% said they checked settings regularly.
Reported review rates varied by control: 40.4% for Conditional Access, 32.2% for administrator-account protection, 11.0% for OAuth application permissions, and 10.1% for audit-log or alert settings. The survey also reported AI-tool integrations such as Microsoft 365 Copilot at 90.1%; among organizations with those integrations, 29.4% regularly reviewed related access permissions. Regular inventories of privileged roles were reported by 38.6%.
The most frequently reported obstacles to reviewing settings were unclear screens or options (32.5%) and concern about disrupting existing work or integrations (31.8%). The cost of higher-tier licenses, including Microsoft 365 E5, was cited by 10.8%.
How an account can be compromised after MFA
Microsoft has separately described adversary-in-the-middle (AiTM) phishing, in which an attacker proxies a real sign-in and relays the user’s MFA interaction. The attacker can capture the resulting session cookie, a browser token that keeps the user signed in, and replay it to access the authenticated session.
Microsoft has also described a separate campaign in which an attacker used a stolen session and weak controls on MFA updates to add a phone-based one-time password method. In its November 2024 guidance, Microsoft identified passkeys, certificate-based authentication, and Windows Hello for Business as phishing-resistant credentials supported by Microsoft Entra. Its guidance also recommends FIDO2 security keys and Conditional Access as part of layered protection.
What a response covers beyond a password reset
For the separate campaign it described, Microsoft’s response guidance included resetting credentials, revoking sessions, and undoing unauthorized MFA changes. Those actions address both a stolen authenticated session and an authentication method added by an attacker. Microsoft describes MFA as an important identity-security measure, alongside phishing-resistant authentication and other access controls.
