Multi-factor authentication
Multi-factor authentication (MFA) verifies control of an account using two or more distinct factor types, such as knowledge of a password and possession of a security key.
Count factors, not screens
MFA combines distinct authentication factors. What matters is the evidence the method checks, not how many screens a user sees. A single authenticator can supply multiple factors, so an MFA sign-in does not always involve a separate code or push notification.
MFA makes a stolen password less useful by requiring another factor. The method still matters. A password plus a typed one-time code can meet an MFA requirement, but an impostor can relay that code. Phishing-resistant MFA adds protection against that kind of sign-in deception.
Ask which accounts and which methods
“MFA is enabled” leaves practical questions unanswered. Does it cover the application being accessed? Which methods satisfy the policy? Are any accounts excluded? For a particular sign-in, inspect the authentication result rather than assuming an enrollment record means MFA was required and completed.
Recovery needs attention too. If someone can persuade the help desk to replace a factor, the protection can be undermined without breaking the authentication protocol. Treat method replacement as an account-access decision.