A cracked password of a 365/Azure user with MFA enabled and under the watch of standard MS security tools is not very useful for an attacker. Multi-factor authentication (MFA) adds an extra layer of security to user accounts by requiring users to provide two or more forms of authentication to verify their identity. Even if an attacker manages to crack the password of a user with MFA enabled, they still need access to the secondary authentication factor (such as a token or biometric data) to gain access to the account.

Furthermore, Microsoft’s standard security tools, such as Azure Active Directory Identity Protection and Microsoft Defender for Identity, are designed to detect and prevent unauthorized access attempts, including those that use compromised credentials. These tools use a combination of machine learning algorithms, behavioral analytics, and threat intelligence to monitor user activity and identify suspicious behavior. If an unusual login attempt is detected, these tools can automatically block the access or trigger an alert for further investigation.

Overall, while a cracked password may give an attacker some information about the user’s account, it is not sufficient to gain access to the account if MFA is enabled and Microsoft’s standard security tools are in place.