Microsoft Mechanics' latest short highlights an uncomfortable trend for identity teams: credential attacks are still the dominant problem, but attackers are increasingly shifting toward ways to bypass credentials after users adopt stronger sign-in controls. The video notes that Microsoft detected 147,000 token theft attacks in the last year, a 111% increase from the previous year. Token theft is a signal that identity security has moved beyond the sign-in prompt.
What Microsoft Mechanics highlighted
The core message is not that multi-factor authentication has stopped mattering. MFA remains essential, and Microsoft specifically points to passkeys as a preferred direction because they reduce reliance on reusable passwords and resist common phishing patterns better than traditional factors.
The warning is that MFA success changes attacker behavior. When passwords alone are harder to use, adversaries look for session tokens, refresh tokens, cookies, device artifacts, and other proof-of-authentication material that can let them impersonate a user without completing a fresh MFA challenge. In practice, this means an account can be protected by MFA and still be at risk if an attacker can steal or replay an active session.
Why token theft matters for IT and cloud teams
For cloud administrators, token theft is especially dangerous because it targets the trust fabric around identity. Tokens are often used after authentication to access cloud portals, APIs, collaboration tools, SaaS applications, and management planes. If a stolen token is accepted as valid, the attacker may appear to be an already-authenticated user rather than a suspicious login attempt.
That changes detection and response priorities. Security teams cannot rely only on failed password attempts, impossible travel alerts, or missing MFA prompts. They need visibility into session behavior: unfamiliar devices, unusual token use, abnormal application access, unexpected privilege activity, and access patterns that differ from the user's normal baseline.
Practical controls to prioritize
Organizations should keep MFA, but treat it as one layer in a broader identity defense program. Priorities include moving high-value users toward phishing-resistant authentication such as passkeys or certificate-backed methods, enforcing conditional access policies, and limiting session lifetime for sensitive roles.
Device posture also matters. Token theft often depends on endpoint compromise, malicious browser extensions, adversary-in-the-middle phishing, or malware that can access cookies and session material. That makes endpoint detection, browser hardening, least privilege on devices, and rapid isolation workflows part of the identity security strategy.
Cloud teams should also review how privileged roles are assigned. Standing administrative access increases the blast radius of a stolen session. Just-in-time elevation, privileged access workstations, role activation approvals, and stronger controls for break-glass accounts can reduce the value of any single stolen token.
Operational impact
The operational takeaway is that MFA deployment should not be treated as the finish line. If your dashboards only measure MFA coverage, you may miss the next wave of identity attacks. Add metrics for phishing-resistant authentication adoption, risky session detection, token revocation speed, conditional access coverage, and privileged role exposure.
Incident response plans should include token-specific steps: revoke sessions, rotate affected credentials, review OAuth consent grants, inspect sign-in and audit logs, check for mailbox or application persistence, and validate endpoint health before allowing the user back into normal access.
Bottom line
MFA remains essential, but attackers are adapting. The sharp rise in token theft means identity programs need to protect the full session lifecycle, not just the initial login. For Microsoft cloud environments, the strongest posture combines phishing-resistant authentication, conditional access, endpoint protection, privileged access controls, and fast token revocation during incidents.