What is Multi-Factor Authentication?
Multi-Factor Authentication (MFA) adds an extra layer of security beyond just a username and password. After entering your password, you must verify your identity through a second method—typically your phone or a hardware security key. Even if an attacker steals your password, they can’t access your accounts without this second factor.
According to Microsoft, MFA blocks 99.9% of automated account attacks. It’s one of the most effective security controls you can implement.
Why Passwords Aren’t Enough
Passwords alone are vulnerable:
- Phishing - Users tricked into entering credentials on fake sites
- Data breaches - Leaked passwords from other sites (people reuse passwords)
- Brute force - Automated guessing of weak passwords
- Keyloggers - Malware that captures typed passwords
- Credential stuffing - Automated login attempts with leaked credentials
MFA renders stolen passwords useless. The attacker has your password? They still can’t get in without your phone.
MFA Methods We Support
Authenticator Apps
Hardware Keys
Push & Biometric
MFA Methods
Authenticator Apps (Recommended)
Apps like Microsoft Authenticator or Google Authenticator generate time-based codes (TOTP) or receive push notifications:
- No cell service required (codes work offline)
- Push notifications are even easier than typing codes
- More secure than SMS
Hardware Security Keys
Physical devices like YubiKey provide the strongest protection:
- Immune to phishing (cryptographic verification of sites)
- No batteries or network required
- Best for high-security accounts
Push Notifications
Phone receives a prompt asking “Are you trying to sign in?”
- Just tap approve/deny
- Shows location and device info
- Very user-friendly
SMS/Text Message
Codes sent via text message:
- Easy to set up
- Works on any phone
- Less secure due to SIM swapping risks
Biometrics
Fingerprint or facial recognition:
- Extremely convenient
- Often combined with other factors
- Device-dependent
How It Works
Assessment
Review current authentication, identify applications requiring MFA protection.
Platform Selection
Choose MFA solution based on your applications and user preferences.
Configuration
Configure MFA policies, conditional access rules, and integrations.
User Enrollment
Guide users through enrolling their authentication methods.
Testing
Verify MFA works correctly for all protected applications.
Enforcement
Enable enforcement and monitor for issues.
Implementation Approach
Phase 1: Admins & IT
Start with privileged accounts that have the most access and risk.
Phase 2: High-Risk Applications
Enable MFA for applications with sensitive data: email, finance, HR systems.
Phase 3: All Cloud Applications
Expand to all cloud applications through SSO integration.
Phase 4: VPN & Remote Access
Protect network access for remote workers.
Phase 5: Workstation Login
Optional: require MFA for Windows/Mac login (high-security environments).
Key Benefits
99.9% Attack Prevention
MFA stops virtually all automated credential attacks.
Stolen Password Protection
Even if passwords leak, attackers can't get in without the second factor.
Compliance Requirement
MFA is required by HIPAA, PCI-DSS, cyber insurance, and more.
User-Friendly Options
Push notifications and biometrics make MFA seamless.
Single Sign-On Integration
Authenticate once, access all your applications.
Risk-Based Policies
Require MFA only when risk is detected—trusted locations skip extra steps.
Conditional Access
Modern MFA doesn’t have to be all-or-nothing. Conditional access policies apply MFA based on risk:
- Trusted locations - Skip MFA from the office network
- Compliant devices - Skip MFA from managed computers
- New locations - Always require MFA from new cities/countries
- Admin portals - Always require MFA for administrative access
- Impossible travel - Require MFA when logins suggest stolen credentials
This balances security with user experience.
Frequently Asked Questions
What is multi-factor authentication?
MFA requires two or more verification factors to authenticate: something you know (password), something you have (phone or hardware key), or something you are (fingerprint). An attacker who steals your password still can't log in without the second factor.
Is MFA annoying for users?
Modern MFA is quite seamless. Push notifications require just tapping 'approve' on your phone. Biometrics (fingerprint, face) are even faster. Conditional access can skip MFA from trusted locations/devices, so users in the office might only see MFA occasionally.
What if someone loses their phone?
We configure backup methods during enrollment—backup codes, alternate phone numbers, or hardware keys. Admins can also temporarily bypass MFA while a user recovers access. Lost phones can have their MFA token revoked immediately.
Which applications should require MFA?
At minimum: email, cloud storage, VPN, and any application with sensitive data or administrative access. Ideally, everything with single sign-on integration gets MFA through the identity provider.
What about shared accounts?
Shared accounts are challenging with MFA. Better approaches: eliminate shared accounts where possible, use privileged access management for shared admin accounts, or use hardware keys that can be passed between users.
Is SMS-based MFA secure?
SMS is better than no MFA, but not as secure as authenticator apps or hardware keys. SIM swapping attacks can intercept SMS codes. We recommend authenticator apps as the default, with SMS as a backup for accessibility.