Multifactor Authentication (MFA) | Microsoft Security (2024)

FAQs

What is an MFA security? ›

Multi-factor authentication (MFA) is a multi-step account login process that requires users to enter more information than just a password. For example, along with the password, users might be asked to enter a code sent to their email, answer a secret question, or scan a fingerprint.

Using multi-factor authentication (MFA) is one of the best ways to help keep your online accounts secure. While MFA can be defeated (since no tool is 100% perfect), the extra step creates a roadblock that may make a cybercriminal more likely to move on to the next target.

With MFA enabled, your accounts are more secure, and users can still authenticate to almost any application with single sign-on (SSO). There are multiple ways to enable MFA for your Microsoft Entra users based on the licenses that your organization owns.

MFA increases security because even if one credential becomes compromised, unauthorized users will be unable to meet the second authentication requirement and will not be able to access the targeted physical space, computing device, network, or database.

In a phishing attack, cybercriminals trick users into revealing their credentials or MFA codes by masquerading as a legitimate entity. Once the attacker has both the password and the MFA code, they can gain access just as easily as the legitimate user.

The most secure Multi-Factor Authentication method is a phishing-resistant type of MFA, which means that attackers cannot intercept or dupe users into providing account access. Phishing-resistant types of MFA include FIDO2 and WebAuthn standard, hardware-based security keys.

With passwords alone being simple work for hackers, MFA provides an essential layer of protection against breaches. However, it's important to remember that MFA isn't foolproof. It can be bypassed, and it often is.

Multifactor Authentication Prevents 99.9% of Cyber Attacks.

MFA that relies solely on a phone number is typically more vulnerable to attacks than MFA that is compatible with authentication apps offered by Microsoft, Google and others. Hackers are able to overtake someone's phone number using a tactic called SIM-swapping, which would give them access to a text-based login code.

Factors that rely on your phone number, such as SMS and phone calls should be avoided if possible as they are the least secure and provide the worst user experience.

Why is MFA not enough? ›

MFA isn't strong enough

In fact, some MFA implementations are simply ineffective. For example, some are susceptible to cyberthreats, such as push bombing, in which cyberattackers push out a high volume of notifications to end users requesting they enter their credentials.

Multi-factor authentication (MFA) is more secure than two-factor authentication (2FA) These two terms are often used interchangeably, but they're not quite the same thing. 2FA requires exactly two authentication types to unlock something. MFA requires a minimum of three forms of authentication.

In addition to protecting against security weaknesses or compromised login information, enabling MFA also helps protect online accounts from phishing attempts. A phishing attempt is an email that tries to obtain confidential information like credit card numbers, usernames or passwords.

MFA is significantly more secure than conventional password logins, but still susceptible to bypass. SSO is secure but is a single point of failure; if the IdP account is compromised, many others may also be. MFA adds a step beyond inputting a password but is still relatively seamless.

Another limitation of MFA is that it doesn't help if users create weak passwords for their accounts. If someone manages to guess or crack your password, then MFA won't do anything to stop them from accessing your account.

MFA is significantly more secure than conventional password logins, but still susceptible to bypass. SSO is secure but is a single point of failure; if the IdP account is compromised, many others may also be. MFA adds a step beyond inputting a password but is still relatively seamless.

The program is often viewed as an opportunity to build your portfolio, network with professionals and peers, explore new techniques, and take advantage of mentorship and fellowship opportunities. The MFA may also help you qualify for more job opportunities and prepare you for multiple career paths.

Security Keys

For multi-factor authentication, they need to be used in conjunction with a password or other authenticator, like a FIDO passwordless app. One factor relies on verifying details that represent, "something you are" such as biometrics in terms of fingerprint or facial recognition for authentication.