What MFA is
With multi-factor authentication (MFA) you prove your identity with at least two independent factors: something you know (password), something you have (smartphone, security key) or something you are (fingerprint, face). If the password is stolen, access stays closed without the second factor.
Which methods exist
- Authenticator app (TOTP or push): widespread and easy to handle. Push with number matching makes fatigue-based attacks harder.
- FIDO2 security keys and passkeys: particularly resistant to phishing because sign-in is bound to the genuine website.
- Hardware tokens and smart cards: common in certain environments.
- SMS codes: better than nothing but more vulnerable, for example to SIM swapping. Only as a fallback.
Where MFA belongs first
Start with administrator accounts, email and remote access (VPN, remote desktop, cloud services). Then all user accounts with access to company data. In environments with Microsoft Entra ID, rules can be controlled through conditional access, for example MFA outside the company network.
How to introduce MFA
- Define the method and limit exceptions clearly.
- Plan emergency access: two break-glass accounts for administrators, kept securely and monitored, so a mistake does not lock you out.
- Start a pilot group, gather experience, then roll out step by step.
- Support employees: short guide, contact person, help when changing devices.
- Define recovery: what happens when a smartphone is lost?
- Switch off legacy sign-in methods that bypass MFA.