Multifactor authentication (MFA)
What it is
Multifactor authentication (MFA) asks for two or more independent proofs during a sign-in. For example, a password is something you know and a prompt in Microsoft Authenticator or a security key is something you have. A fingerprint or face scan can be something you are.
Why it exists
Passwords can be guessed, reused, phished, or exposed. MFA adds another check, making a stolen password alone less useful to an attacker. It reduces risk; it does not make a badly designed access policy safe by itself.
Key ideas
- Methods: Microsoft Entra supports methods including Microsoft Authenticator, passkeys, Windows Hello for Business, certificates when configured for MFA, hardware or software OATH tokens, SMS, and voice calls. The safe and available choice depends on the tenant’s policy and scenario.
- Security defaults: a tenant-wide starting configuration that can quickly enable Microsoft Authenticator for users.
- Conditional Access: adds more precise rules, such as requiring MFA for a particular app or sign-in context. It is the usual choice when the organization needs that control.
- Registration: users must enroll permitted methods before they can complete a challenge. Plan a safe registration and recovery path, especially for administrators.
Northwind example
Luis signs in to the Northwind ordering portal. His password proves one factor; an Authenticator approval supplies another. Northwind uses Conditional Access to require MFA for the protected application under its chosen conditions. If Luis loses his phone, the help-desk recovery process—not a public IP address or Azure RBAC role—determines how he safely enrolls another method.
How it fits (diagram)
Diagrams courtesy of Microsoft Learn / Azure docs: entra/identity/authentication/concept-mfa-howitworks
Exam notes
- MFA proves a sign-in; it does not decide which Azure resources the signed-in person may manage. That is an authorization decision such as rbac.
- MFA challenges are part of the Microsoft Entra sign-in experience, so applications normally do not each need their own MFA implementation.
Related
conditional-access · entraid · password-reset