Multifactor authentication (MFA)
What it is
MFA is a sign-in requirement that asks for two or more proofs of identity — typically something you know (password), plus something you have (phone/app) or are (biometric) — before granting access.
Why it exists
Passwords alone are weak (reused, phished, leaked). MFA dramatically reduces account-takeover risk by adding a second factor an attacker won’t have, even if they steal the password.
Key ideas
- Factors — knowledge, possession (Authenticator app, SMS/phone call, hardware key), and inherence (biometrics).
- Per-user vs Conditional Access — the legacy per-user MFA forcing is being superseded by Conditional Access policies that require MFA for specific sign-in risk/contexts (the modern, recommended approach).
- MFA registration — users register via combined security-info registration (sign-in + MFA).
- Security defaults — a tenant setting that enforces MFA for all users; a common starting point.
How it fits (diagram)
Diagrams courtesy of Microsoft Learn / Azure docs: entra/identity/authentication/concept-mfa-howitworks
Exam notes
- Prefer Conditional Access to per-user MFA forcing for least-disruption, context-aware protection.
- Understand the survivable token / registration process and how administrators can temporarily bypass or validate registration.
- MFA is enforced by policy, not a setting on the account itself in modern tenants.
Related
conditional-access · entraid · password-reset
📘 Source: Microsoft Learn — Mfa