Multi-factor authentication
noun · also MFA · NIST CSRC Glossary
Signing in with two or more different kinds of proof, such as a password plus a phone or security key, so a stolen password alone is not enough.
Multi-factor authentication (MFA) asks for proof from more than one category:
- Something you know: a password or PIN.
- Something you have: a phone with an authenticator app, a hardware security key, a smart card.
- Something you are: a fingerprint or face, usually used to unlock the device that holds the real credential.
Two passwords are not MFA, because both are the same kind of factor. Two-factor authentication (2FA) is simply MFA with exactly two factors.
Not all MFA is equally strong. SMS codes can be intercepted or redirected through SIM swapping, push notifications can be approved by a tired or tricked user, and one-time codes can be typed into a phishing page. Phishing-resistant methods such as passkeys and FIDO2 keys close those gaps.
Example
An attacker buys a list of leaked passwords and tries them against your Microsoft 365 tenant. One of them is still valid, but the sign-in stops at the MFA prompt, because the attacker does not have the user's phone. The sign-in log records a correct password followed by a failed MFA challenge, which is a strong signal that the password must be reset.
Why it matters for a SOC analyst
Microsoft has repeatedly reported that MFA blocks the overwhelming majority of automated account attacks, which is why "is MFA enforced for this account?" is one of the first questions in any identity investigation. Also check which method was used: an attacker who passed MFA by approving a push, relaying a code or replaying a stolen session cookie points to a very different story than a password alone.
Articles that use this term
Threat Analysis · · 4 min read
MFA fatigue attacks: how push bombing works and how to stop it
Why attackers flood users with MFA prompts until one gets approved, what the Uber and Cisco breaches teach us, and the controls that make push bombing fail.
Tutorials · · 4 min read
Investigating a suspicious sign-in in Entra ID, step by step
What to check in the sign-in logs, which KQL queries to run, how to compare against the user's normal behavior, and when to revoke sessions and reset access.
Related terms
- Phishing-resistant MFA
Authentication methods, such as passkeys, FIDO2 keys and Windows Hello for Business, that cannot be relayed or approved by a phished user.
- MFA fatigue
An attack that floods a user with MFA push prompts, using a stolen password, until the user approves one out of confusion or annoyance.
- Conditional Access
Microsoft Entra ID's policy engine that decides, at each sign-in, whether to allow access, require MFA or another control, or block.
- Adversary-in-the-middle phishing
Phishing that relays the victim's sign-in to the real site through an attacker's proxy, stealing the session cookie after MFA succeeds.