What Is Multi-Factor Authentication, and Which Type Should Your Business Use?
Multi-factor authentication, MFA, means proving who you are with more than a password: something you know plus something you have, such as your phone, or something you are, such as a fingerprint. It is the single control that stops the most common attack on a small business, a criminal signing in with a stolen password, and cyber insurers, regulators and Microsoft itself now expect it everywhere. But MFA comes in several types, and the weakest ones are now routinely beaten. This article explains what MFA is, the types from weakest to strongest, how attackers get around the weak ones, and what a business should turn on first. Our separate MFA setup guide covers the how-to for Microsoft 365, and the surprisingly popular why do I keep receiving Microsoft Authenticator codes covers what unexpected prompts mean.
Why a password is not enough
Passwords leak. They are phished, reused across sites, guessed from patterns, and sold in bulk from other companies’ breaches. Every incident-response report of the last several years puts stolen credentials at or near the top of how attackers get in, and a criminal with a valid password looks exactly like the employee. MFA breaks that: the password alone opens nothing. Microsoft has reported for years that MFA blocks the overwhelming majority of automated account attacks, which is why it is the first control on every checklist, including the cyber insurance readiness check.
The types, weakest to strongest
| Type | How it works | Weakness | Use it for |
|---|---|---|---|
| Codes by text message or email | A one-time code is sent to your phone or inbox | SIM-swapping steals the number; codes are easily phished; email codes fail if email is what was compromised | Only where nothing better is offered |
| Authenticator app codes | An app such as Microsoft Authenticator or Google Authenticator generates a code every 30 seconds | Codes can be phished in real time by a relay site | General accounts where push is not available |
| Push notification with approve/deny | The app asks “was this you?” | MFA fatigue: attackers spam prompts until someone taps approve | Avoid without number matching |
| Push with number matching | The sign-in screen shows a number; you type it into the app | Still phishable by a relay site that shows the number | Good default for staff; what Microsoft enforces by default |
| Hardware security key | A small USB or NFC key you touch to sign in; FIDO2 standard | Must be carried; costs $25 to $60 per key | Administrators, finance, executives, anyone with elevated access |
| Passkey | A cryptographic key stored on your phone or computer, unlocked by fingerprint, face or PIN; also FIDO2 | Depends on the device being managed and backed up | The direction of travel for everyone; replaces the password as well as the second factor |
How attackers beat the weak types
Three techniques account for most MFA bypasses today. SIM swapping moves a phone number to the attacker’s SIM through the carrier, so text-message codes arrive with them. MFA fatigue uses a stolen password to trigger push prompts repeatedly until a tired employee approves one; number matching ends it. Adversary-in-the-middle phishing is the serious one: the victim clicks a link to a perfect copy of the Microsoft sign-in page, which relays the password and the code to the real site in real time and steals the resulting session token, so the attacker is signed in and MFA appears to have worked. Only hardware keys and passkeys defeat that, because the key is bound to the real site’s address and will not sign in to an impostor. That is what “phishing-resistant MFA” means, and it is why we move administrators and finance staff to it first.
What to turn on first
- Email and the identity system: Microsoft 365 or Google Workspace, for every account, enforced by Conditional Access or security defaults rather than left to individuals. Email resets everything else.
- Remote access: the VPN, remote desktop, and any remote-support tool. An unprotected VPN is one of the most common ways ransomware starts.
- Money: the bank, payroll, accounting and payment systems.
- Anything with an administrator role: the firewall, the backup service, the domain registrar, the password manager, the website.
- Everything else over the following months, starting with whatever holds customer data.
For staff, an authenticator app with number matching is a sound default. For administrators, finance staff, executives and anyone who approves payments, use passkeys or hardware keys. Shared mailboxes and service accounts need their own approach, since nobody’s phone is attached to them; this is where Conditional Access and app-specific settings do the work.
Making it livable
Well-configured MFA is not a code on every sign-in. Trusted, managed devices are remembered; Conditional Access prompts only when something is unusual, such as a new device or country; Windows Hello signs the person into the computer and into Microsoft 365 with a fingerprint or face; passkeys are faster than passwords. The pain people remember comes from MFA that was switched on without any of that, which is a configuration problem rather than a reason to skip it. Set it up with recovery in mind too: a second method registered for each person, and an emergency administrator account with its credentials sealed and stored offline, so a lost phone is an inconvenience rather than a lockout.
MFA is necessary, not sufficient
MFA stops the password attacks. It does not stop malware that arrives by email, an unpatched firewall, a stolen laptop with no encryption, or a session token lifted by a phishing kit. It sits alongside endpoint detection, patching, encryption, email filtering, backups and trained people, all described in our article on firewalls, antivirus and EDR and delivered as part of managed cybersecurity services. Our guide to creating secure passwords covers the password half of the sign-in, and what Microsoft 365 Business Premium includes lists the licence features, Conditional Access above all, that make MFA enforceable rather than optional.
Free tools from OAC Technology
- Cyber insurance readiness check: fourteen questions insurers ask, scored in a minute
- Phishing quiz: ten realistic emails, one at a time, with the tells explained
- Microsoft 365 plan picker: which Microsoft 365 plans fit your people
Common questions
Is a text-message code good enough?
Better than nothing and the weakest option. Codes sent by SMS can be intercepted by SIM-swapping the phone number and are easily phished. Use an authenticator app with number matching at minimum, and passkeys or hardware keys for administrators and finance staff.
What is MFA fatigue?
An attacker who has your password triggers sign-in prompts again and again, hoping you approve one to make them stop. Number matching, where the prompt shows a number you must type from the sign-in screen, defeats it, and so does never approving a prompt you did not start.
Can MFA be phished?
The code-based kinds can. Phishing kits now sit between the person and the real site, relay the password and the code in real time, and steal the signed-in session. Passkeys and hardware keys cannot be relayed this way, which is why they are called phishing-resistant and why they are recommended for anyone with elevated access.
Does MFA slow people down?
Less than it used to. Modern sign-in remembers trusted devices, Conditional Access asks only when something is unusual, and passkeys are faster than typing a password. The daily experience is a fingerprint or a tap, not a code every time.
What is a passkey?
A sign-in method that replaces the password entirely with a cryptographic key stored on your phone or computer, unlocked by fingerprint, face or PIN. Nothing is typed and nothing can be reused elsewhere. Microsoft, Google and Apple accounts support passkeys, and Microsoft Entra ID supports them for business sign-in.
Where should we turn MFA on first?
Email, because it resets everything else; then remote access such as VPN and remote desktop; then the bank, payroll and accounting systems; then everything with an admin role. Enforce it through a policy rather than asking people to enable it themselves.
Talk to us
If MFA is still optional anywhere in your business, or your administrators are still using text-message codes, we will enforce it properly, with recovery set up, usually within a week. Call 952-548-5558 or contact us; the first conversation is free and there is no long-term contract.
