> If they know your password no amount of device encryption will protect you, that is why he is ignoring them.

I can set a 128-bit equivalent password on my computer. I don't know how to ensure that Microsoft's cloud provides equivalent security, given the existence of password recovery mechanisms (SMS, email, security questions and social engineering of MS customer service reps).

But I'm not that familiar with Microsoft's cloud operations. If there is a way, let me know.