Definition
Multi-factor authentication, MFA, also called two-factor authentication or 2FA, is a login method that requires two or more separate proofs of identity: something you know (a password), something you have (a phone, an authenticator app or a hardware key) and sometimes something you are (a fingerprint or face). Even if an attacker steals your password, they cannot log in without the second factor. It is the single most effective security control available for the effort it takes.
In a company, MFA should protect every account that matters: email, cloud consoles, banking, the code repository, the CRM, the payroll system and any tool with customer data. Most SaaS products support it, and identity providers let you enforce it centrally for the whole team. The strongest forms are hardware security keys and passkeys, which resist phishing entirely. Codes sent by SMS are weaker but far better than nothing. Enterprise customers and cyber insurers now ask whether MFA is enforced before doing business.
Microsoft's published research, based on measurement of its own cloud accounts, found that enabling MFA reduces the risk of account compromise by over 99%, and Microsoft has made it mandatory for its cloud administration. The misconception is that MFA is a burden for staff. Modern methods take a second, and passkeys are faster than typing a password. The other misconception is that MFA is optional for small companies; attackers test stolen passwords against every company, regardless of size.
In practice
In the companies I run, MFA is enforced on every account from the first day of employment. When a leaked password from an unrelated website was tried against a manager's email, the attempt failed at the second factor and the security team got an alert instead of a breach.
Why it matters
MFA is the cheapest, highest-return security decision you can make this week. If any account in your company with access to money or customer data does not require a second factor, that is the first item on your risk list.
Frequently asked questions
- What is the difference between 2FA and MFA?
- Two-factor authentication (2FA) uses exactly two proofs of identity, typically a password plus a code or device. Multi-factor authentication (MFA) is the general term for two or more factors. In practice the terms are used interchangeably, and both dramatically reduce the risk of account takeover compared to a password alone.
- Is SMS two-factor authentication secure?
- It is much better than a password alone but weaker than other methods, because SMS codes can be intercepted through SIM swapping or phishing. Authenticator apps, hardware security keys and passkeys are stronger, and passkeys are also faster for users. Use SMS only where nothing better is available.