Identity · Authentication
Multi Factor Authentication
Requiring two or more independent factors, something you know, have or are, before granting access.
FoundationalUpdated 2026-09-01
Overview
MFA remains the single highest value control against credential theft, but not all MFA is equal. Push notifications and one time codes can be phished or fatigued; FIDO2 security keys, passkeys and certificate based authentication are phishing resistant because the credential is bound to the origin and cannot be replayed.
MFA protects authentication, not the session that follows. Token theft, adversary in the middle proxies and consent phishing all sidestep a successful MFA prompt, which is why session controls and device trust matter alongside it.
How it works
- 01The identity provider requires an additional proof after or alongside the primary credential, then records the satisfied factor in the resulting token claims.
- 02Policy engines such as Conditional Access decide when the additional factor is required, based on risk, device state, location and application sensitivity.
- 03FIDO2 uses a key pair bound to the relying party's origin; the private key never leaves the authenticator and signatures cannot be reused elsewhere.
Reference table
| Method | Resistance to phishing | Notes |
|---|---|---|
| SMS or voice one time code | Low | Vulnerable to SIM swap and interception; avoid for privileged use |
| TOTP authenticator app | Low–Medium | Not origin bound; can be relayed by a proxy |
| Push notification | Medium | Improved with number matching and context display |
| Certificate based authentication | High | Requires PKI and device credential management |
| FIDO2 security key / passkey | High | Origin bound public key cryptography; cannot be replayed |
| Platform passkey with device biometric | High | Strong and low friction where supported |
Security considerations
- Prioritise phishing resistant methods for administrators, finance, executives and any remote access path.
- Disable weak fallback methods once stronger ones are enrolled, attackers target the weakest enabled method.
- Protect the registration process itself; unmanaged self service enrolment from any location is a common gap.
- Enable number matching and additional context to reduce prompt bombing success.
Common misconfigurations
- Legacy authentication left enabled, allowing MFA bypass entirely.
- Broad exclusions for 'service accounts' or 'shared mailboxes' never revisited.
- Very long session lifetimes or persistent 'remember MFA' windows on unmanaged devices.
- No monitoring of MFA method registration changes, a classic persistence technique.