Multi-factor authentication (MFA) is a login method that requires two or more separate proofs of identity, such as a password plus a code from an authenticator app, before granting access to an account. It exists because passwords fail: they get phished, guessed, reused, and leaked in breaches. With MFA, a stolen password alone isn’t enough. Microsoft has reported that MFA blocks over 99% of automated account-compromise attacks. It’s the single most effective security control a business can deploy, it’s cheap, and cyber insurers, compliance frameworks, and clients now treat it as mandatory.
In this guide
- How multi-factor authentication works
- Why MFA matters
- Types of MFA, ranked by strength
- MFA vs. 2FA vs. passwordless
- Where to enforce MFA
- How attackers bypass weak MFA
- How to roll out MFA in a business
- MFA tools compared
- Common mistakes
- How Sixwatch implements MFA
- FAQ
- Glossary
How multi-factor authentication works
Authentication factors fall into three categories:
- Something you know: a password or PIN
- Something you have: a phone with an authenticator app, a hardware security key, a smart card
- Something you are: a fingerprint, facial recognition, or other biometric
MFA requires factors from at least two different categories. A password plus a second password isn’t MFA. A password plus a code from your phone is.
The login flow: you enter your username and password (something you know). The system then asks for the second factor: a six-digit code from an authenticator app, a tap on a push notification, a touch on a hardware key, or a fingerprint (something you have or are). Only with both does the login succeed.
An attacker who phished your password hits the second step and stops, unless the MFA method itself can be phished, which is why the type of MFA matters.
Why MFA matters
- Stolen credentials remain among the top initial access methods in ransomware and business email compromise attacks — in the 2026 Verizon DBIR, vulnerability exploitation edged them out of the #1 spot for the first time in 19 years.
- Billions of username and password pairs from past breaches circulate on the dark web. Attackers test them against your Microsoft 365 login automatically (credential stuffing). If any employee reused a password, they’re in.
- Cyber insurers require MFA on email, remote access, and admin accounts as a condition of coverage. Claims have been denied when it wasn’t actually enabled.
- HIPAA’s proposed Security Rule update (final rule now expected in 2027), CMMC, PCI DSS 4.0, and the FTC Safeguards Rule all require MFA.
- Microsoft, Google, and most SaaS platforms now enforce or strongly push MFA by default.
For a small business, MFA is the difference between a phished password being a non-event and being the start of a six-figure incident.
Types of MFA, ranked by strength
| Method | How it works | Phishing-resistant? | Notes |
|---|---|---|---|
| Hardware security keys (FIDO2 / passkeys) | A physical key (YubiKey, etc.) or a device-bound passkey that cryptographically verifies the real site | Yes | Strongest option; immune to phishing pages, MFA fatigue, and man-in-the-middle attacks |
| Device-bound passkeys | Same FIDO2 standard, stored on your phone or laptop with biometric unlock | Yes | No hardware to buy; now supported by Microsoft, Google, Apple |
| Authenticator app with number matching | Push notification requires typing a number shown on the login screen (Microsoft Authenticator, Duo) | Partial | Defeats MFA fatigue; still vulnerable to real-time phishing proxies |
| Authenticator app, time-based one-time passwords (TOTP) | Six-digit codes that rotate every 30 seconds | No | Better than SMS; codes can be phished in real time |
| Push notification (simple approve) | Tap Approve on your phone | No | Vulnerable to MFA fatigue attacks |
| SMS or voice codes | A code sent by text or call | No | Weakest; vulnerable to SIM swapping, interception, and phishing. NIST discourages it. |
| Email codes | A code sent to your email | No | Useless if the email account is what’s being attacked |
| Biometrics alone | Fingerprint or face | Depends | Strong when tied to a device (passkeys); weak as a remote factor |
The practical hierarchy for businesses in 2026: passkeys or hardware keys for admins and finance staff, authenticator app with number matching for everyone else, SMS never.
MFA vs. 2FA vs. passwordless
- 2FA (two-factor authentication): exactly two factors. A subset of MFA. The terms are used interchangeably in practice.
- MFA: two or more factors.
- Passwordless: the password is eliminated entirely. You sign in with a passkey, security key, or biometric-unlocked device. Still multi-factor (the device is something you have, the biometric something you are), but with no password to phish. This is where Microsoft and Google are steering everyone.
- Adaptive / risk-based MFA: the second factor is required only when something looks risky: a new device, an unusual location, an admin action. Reduces friction without reducing security when combined with conditional access.
Where to enforce MFA
Everywhere, but in this order:
- Email and Microsoft 365 / Google Workspace. The account that resets every other password.
- Remote access: VPN, remote desktop, remote management tools. The top ransomware entry point.
- Administrator accounts: domain admin, cloud admin, firewall, backup consoles. Use hardware keys here.
- Banking, payroll, and payment platforms.
- Password managers.
- Line-of-business applications with sensitive data: EHR, practice management, CRM, accounting.
- Cloud infrastructure: Azure, AWS, Google Cloud consoles.
- Social media and domain registrar accounts. Overlooked; a hijacked domain or company social account is a real incident.
- Workstation login, via Windows Hello for Business or similar.
Use conditional access policies to require MFA for every user on every app, block legacy authentication protocols that bypass MFA, and require stronger methods for privileged roles.
How attackers bypass weak MFA
- MFA fatigue (prompt bombing): repeated push notifications until the user approves one to make it stop. Defeated by number matching.
- Adversary-in-the-middle phishing: a fake login page proxies the real one in real time, capturing the password, the TOTP code, and the session cookie. Defeated only by FIDO2 / passkeys.
- SIM swapping: the attacker convinces the carrier to move your phone number to their SIM, receiving your SMS codes. Defeated by not using SMS.
- Session token theft: malware steals the browser cookie that proves you already authenticated, skipping MFA entirely. Defeated by endpoint detection and token-binding features.
- Consent phishing: the user is tricked into authorizing a malicious app, which needs no password or MFA. Defeated by restricting app consent in Microsoft 365.
- Help desk social engineering: the attacker calls IT pretending to be an employee who lost their phone and gets MFA reset. Defeated by verification procedures.
- Legacy authentication: old protocols (IMAP, POP, SMTP basic auth) that don’t support MFA. Defeated by blocking them.
How to roll out MFA in a business
- Inventory accounts and applications. Which support MFA natively, which need single sign-on to get it.
- Choose methods: authenticator app with number matching as the baseline; passkeys or hardware keys for admins, executives, and finance.
- Pilot with IT and a friendly department. Fix the enrollment guide.
- Communicate. Why, when, what to expect, who to call. Employees who understand the reason comply faster.
- Enroll in waves, with a deadline and a grace period. Provide in-person help for the first week.
- Enforce via conditional access. Require MFA for all users and all apps; block legacy authentication; require stronger factors for privileged roles.
- Set up backup methods and recovery procedures so a lost phone isn’t a lockout, and verification procedures so a “lost phone” call isn’t an attack.
- Monitor: enrollment completion, failed MFA attempts, new MFA device registrations (a common attacker persistence step).
- Move toward passwordless over the following year.
A 50-person business can complete a full MFA rollout in two to four weeks.
MFA tools compared
| Tool | Best for | Cost |
|---|---|---|
| Microsoft Entra ID (built-in MFA + conditional access) | Microsoft 365 businesses; conditional access requires Entra ID P1 (included in Business Premium) | $0 – $6 / user / mo |
| Google Workspace 2-Step Verification | Google businesses | Included |
| Duo (Cisco) | Mixed environments, VPN and legacy app protection, strong admin features | $3 – $9 / user / mo |
| Okta | Single sign-on across many SaaS apps with MFA | $2 – $15 / user / mo |
| YubiKey / hardware keys | Admins, executives, finance | $25 – $75 per key |
| Windows Hello for Business | Passwordless workstation login | Included with Windows |
Most small and mid-size businesses on Microsoft 365 Business Premium already own everything they need; the work is configuration and rollout.
Common mistakes
- MFA on email but not on VPN, remote desktop, or the backup console. Attackers go around.
- SMS as the primary method. It’s the one attackers know how to beat.
- Simple push without number matching. MFA fatigue works.
- Legacy authentication left enabled. MFA is bypassed silently.
- Exempting executives because they find it annoying. They’re the most targeted users.
- No recovery procedure, so lost phones become emergencies, or a weak one, so attackers reset MFA with a phone call.
- Not monitoring new device registrations. Attackers add their own phone after one successful phish.
- Stopping at MFA. It’s the most important control, not the only one.
How Sixwatch implements MFA
Sixwatch deploys and enforces MFA as part of every managed cybersecurity plan for businesses across Tampa Bay and Cincinnati: authenticator apps with number matching for all users, hardware keys or passkeys for privileged accounts, conditional access policies that require MFA everywhere and block legacy authentication, protected recovery procedures, and monitoring for suspicious MFA registrations. We handle the rollout, the enrollment help, and the insurer questionnaire that asks whether it’s really enabled.
Founder John Owens brings 25+ years of IT and security experience. Every plan includes a 30-minute emergency remote response and same-day onsite support, and our 5.0 Google rating includes clients whose phished password went nowhere.
Thomas was very knowledgeable and quick to help me fix my problem. He even took time after to help me with any other questions I had. Very thankful for his help and how quick he responded.
Chrystal
Book a 15-minute call or request a proposal.
Frequently asked questions
What is multi-factor authentication? A login process that requires two or more independent proofs of identity, such as a password and a code from your phone, so a stolen password alone can’t be used to access the account.
What is the difference between MFA and 2FA? 2FA uses exactly two factors; MFA uses two or more. In everyday use they mean the same thing.
What is the most secure type of MFA? Hardware security keys and passkeys based on the FIDO2 standard. They’re phishing-resistant because they verify the real website cryptographically and can’t be tricked by fake login pages.
Is SMS MFA safe? It’s better than nothing but the weakest option. SMS codes can be intercepted, phished, or stolen through SIM swapping. Use an authenticator app or passkey instead.
Does MFA stop phishing? Phishing-resistant MFA (FIDO2 keys, passkeys) stops credential phishing. App-based codes and push approvals can be bypassed by real-time phishing proxies and MFA fatigue attacks.
Is MFA required for cyber insurance? Nearly every carrier now requires MFA on email, remote access, and privileged accounts as a condition of coverage.
How much does MFA cost? Often nothing; it’s included in Microsoft 365, Google Workspace, and most SaaS platforms. Advanced conditional access and third-party tools run $3 to $9 per user per month. Hardware keys cost $25 to $75 each.
What is passwordless authentication? Signing in without a password, using a passkey, security key, or biometric-unlocked device. It’s still multi-factor but removes the password as an attack target.
Glossary
- Authenticator app: A phone app that generates codes or receives push prompts (Microsoft Authenticator, Google Authenticator, Duo).
- Conditional access: Policies that decide when MFA is required based on user, device, location, and risk.
- FIDO2 / WebAuthn: The open standard for phishing-resistant authentication.
- Legacy authentication: Older protocols that don’t support MFA.
- MFA fatigue: Repeated push prompts sent until the user approves one.
- Number matching: A push prompt that requires entering a number displayed on the login screen.
- Passkey: A FIDO2 credential stored on a device, unlocked by biometric or PIN.
- SIM swapping: Hijacking a phone number to intercept SMS codes.
- TOTP: Time-based one-time password; the six-digit rotating code.
Is MFA actually enforced everywhere in your business, or just on email? Book a 15-minute call · Request a proposal
