Measure login health: success and failure rates, MFA completion, attempts per successful login and lockout rate.
The success rate is the headline, but attempts per successful login is the more sensitive signal: a value creeping above about 1.1 means users are retrying, which precedes a rise in lockouts and helpdesk calls. MFA completion is tracked separately because an abandoned challenge is a usability failure that looks nothing like a wrong password. A falling success rate is the earliest visible symptom of a directory problem, an expiring certificate or a credential stuffing wave, so it belongs on the same dashboard as latency and error rate.
Authentication Success Rate
success rate = successful logins ÷ attempts; MFA completion = challenges completed ÷ challenges issued; attempts per success = attempts ÷ successful logins.
success rate = successful logins ÷ attempts; MFA completion = challenges completed ÷ challenges issued; attempts per success = attempts ÷ successful logins. The success rate is the headline, but attempts per successful login is the more sensitive signal: a value creeping above about 1.1 means users are retrying, which precedes a rise in lockouts and helpdesk calls. MFA completion is tracked separately because an abandoned challenge is a usability failure that looks nothing like a wrong password.
A falling success rate is the earliest visible symptom of a directory problem, an expiring certificate or a credential stuffing wave, so it belongs on the same dashboard as latency and error rate.
This calculator takes 5 inputs: Authentication attempts, Successful logins, MFA challenges issued, MFA challenges completed, Account lockouts. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Interactive enterprise sign-in usually sits between 92 % and 97 %. Consumer platforms run lower because forgotten passwords are common. A sudden drop of several points within an hour is almost always an infrastructure fault rather than user behaviour.
Because credential stuffing floods the denominator with failures. A collapsing success rate alongside a spike in attempt volume from many source addresses is the signature of an attack, not of broken authentication — separate human and automated traffic before reading the metric.