Why is Microsoft forcing Azure tenants to enable MFA?

34-year information security and risk management professional here. I recently received a notice that I must "enable MFA by 15 October 2024" (which is weird since my Azure account is already using MFA). This is another example of "MFA mania" in which cloud providers and other IT service providers are forcing customers to use MFA.

MFA is great, but it is not a "best practice" and offers few benefits for many if not most tenants and use cases. Its primary purpose is to insulate the VENDOR (Microsoft in this case) from potential liability, and its primary EFFECT is to transfer those temporal and monetary costs to tenants. It is NOT "for your safety."

MFA is indeed "more secure" than fixed secret (password) authentication, but NOT necessarily "less risky." The question of whether the total risk of MFA (which includes both its positive AND negative effects on tenants) is worth enabling it is the TENANT'S decision, not Microsoft's.

Negative effects (risks and realized losses) include any monetary cost associated with the MFA method, but more importantly the resulting productivity loss associated with MFA. MFA takes more time than password authentication in the general case. This may be a few seconds for a successful authentication, but in cases where the hard or soft token is inaccessible, may result in minutes or hours of lost productivity. The contingent recovery process may be as trivial as a password reset using an email address (in which case control of the email address is the only actual authentication factor), or it may require human intervention (in which case significant productivity losses are guaranteed).

If Microsoft wants to enhance security and reduce risk, rather than simply to impose non-existent "best practices" on tenants, then it can require 16+ character passwords WITHOUT "password complexity" (which actually reduces the strength of passwords). Such a change would have a linear effect on productivity, and would incur no monetary, temporal, or procedural costs on tenants whose risk assessment does not support MFA.