Identity and security
MFA
Multifactor Authentication
Multifactor Authentication requires a user to prove their identity with more than one type of evidence, typically something they know such as a password, combined with something they have such as a phone or hardware key, or something they are such as a fingerprint, rather than accepting a password alone.
Why MFA matters in a Microsoft estate
MFA matters because identity, access, endpoint, and data controls shape how Microsoft environments are protected. Readers should understand the term and then be able to move into security assessment, conformity, or remediation guidance.
How MFA shows up in practice
This closes off the overwhelming majority of account compromise that stems from credential theft, phishing, or password reuse across breached sites, since a stolen password on its own no longer grants access. Microsoft supports several methods with meaningfully different security properties, and the differences matter more than they first appear. SMS and voice call codes are the weakest widely deployed option, vulnerable to SIM-swapping and interception, and Microsoft has been actively steering organisations away from them. The Microsoft Authenticator app with push notifications and number matching is a substantial improvement, requiring the user to enter a displayed number rather than simply approving a bare 'yes' prompt; this was introduced specifically to counter MFA fatigue attacks, where an attacker with a stolen password floods a user with approval requests until one is accepted out of habit or irritation.
Phishing-resistant methods, FIDO2 security keys, Windows Hello for Business, and certificate-based authentication, represent the strongest tier, since they are cryptographically bound to the specific service being authenticated to and cannot be relayed or replayed the way a one-time code can. How MFA gets enforced is as important as which method is used. Security Defaults provide a basic, non-configurable baseline suitable for smaller tenants with no Conditional Access licensing. Per-user MFA is the older, less flexible mechanism that forces every sign-in regardless of context. Conditional Access-driven MFA, requiring Entra ID P1, is what most mature organisations actually run, since it allows MFA to be required selectively, for risky sign-ins, unmanaged devices, or sensitive applications, rather than uniformly, which reduces user friction without reducing security where it actually matters.
Registration coverage is a frequent operational gap: users who have never completed MFA registration cannot be enforced against. If Conditional Access is set to require MFA without confirming registration completion first, unregistered users get abruptly locked out. This is why registration campaigns with a defined enforcement date, rather than a single policy flip, are the standard rollout pattern. Legacy authentication protocols that predate modern authentication, older versions of POP, IMAP, and some line-of-business application connectors, cannot prompt for MFA at all. They need to be blocked outright rather than assumed harmless, since they represent a complete bypass of MFA regardless of how well the rest of the policy is configured.