If there is one security control that gives your business the most protection for the least effort, it is multi-factor authentication. Passwords get stolen, reused and phished every day. MFA makes a stolen password far less useful to an attacker, which is why it appears in the ACSC Essential Eight and is a baseline expectation for most cyber insurance policies. This guide explains what MFA is, the methods available, and how to roll it out well.
Multi-factor authentication (MFA) requires two or more separate proofs of identity to sign in — usually a password plus a code, app approval or security key. Because an attacker would need both your password and your second factor, MFA blocks the vast majority of account-takeover attacks that rely on stolen credentials alone.
What is multi-factor authentication?
MFA combines factors from at least two of these categories:
- Something you know
- A password or PIN. On its own this is a single factor, and the one most easily stolen.
- Something you have
- A trusted device such as your phone running an authenticator app, or a physical security key.
- Something you are
- A biometric such as a fingerprint or face scan, used to unlock the device or credential.
Two-factor authentication (2FA) is simply MFA with exactly two factors. In practice the terms are used interchangeably.
Why MFA matters
The overwhelming majority of business email compromise and account-takeover incidents begin with a stolen or guessed password. Once an attacker has valid credentials for a single-factor account, they are in. MFA breaks that chain: even a correct password fails without the second factor. The ACSC recommends MFA as one of the most effective controls a business can adopt.
MFA methods compared
Not all MFA is equally strong. Here is how the common methods compare on security and usability.
| Method | Security | Phishing-resistant | Best for |
|---|---|---|---|
| SMS / email codes | Basic | No | A minimum baseline where nothing better is available. |
| Authenticator app (push or code) | Good | Partly | The practical default for most staff and services. |
| Number-matching push | Strong | Mostly | Reducing accidental approvals and MFA-fatigue attacks. |
| Passkeys / FIDO2 security keys | Strongest | Yes | Admins, executives and anyone handling sensitive data. |
SMS codes are far better than nothing, but they are the weakest method — text messages can be intercepted through SIM-swap fraud or captured on a fake login page. Authenticator apps like Microsoft Authenticator are a strong, low-cost default. Passkeys and FIDO2 security keys are the gold standard because they are phishing-resistant.
What is phishing-resistant MFA?
Ordinary MFA can still be defeated by a determined attacker who lures a user onto a convincing fake site and relays the code or push approval in real time. Phishing-resistant MFA — passkeys, FIDO2 security keys and certificate-based authentication — closes that gap. The credential is cryptographically bound to the genuine website, so it simply will not work on a look-alike domain. For admin accounts and anyone handling sensitive information, phishing-resistant MFA is strongly recommended.
How to roll out MFA in your business
A smooth rollout is mostly about planning and communication. A sensible sequence looks like this:
- Inventory your accounts. List every system that supports MFA — Microsoft 365, email, remote access, banking, accounting and line-of-business apps.
- Choose your methods. Standardise on an authenticator app for most staff, and passkeys or security keys for administrators and high-risk roles.
- Start with administrators. Privileged accounts are the highest-value targets, so secure them first.
- Enforce, do not just offer. Use Microsoft Entra ID Conditional Access or security defaults to require MFA rather than leaving it optional.
- Communicate and support. Tell staff what is changing and why, and provide a simple enrolment guide and a fallback for lost devices.
- Plan recovery. Set up secure account-recovery and backup methods so a lost phone does not lock someone out permanently.
MFA and Microsoft 365
If your business runs Microsoft 365, MFA is already included. You can enforce it for everyone through security defaults or, for finer control, through Conditional Access in Microsoft Entra ID. This lets you apply rules such as requiring MFA on new devices or blocking legacy sign-in methods that cannot use it. Microsoft documents the options on Microsoft Learn.
The honest takeaway
MFA is the closest thing to a must-do in modern security, but rolling it out across a busy business — choosing the right methods, enforcing it without frustrating staff, and handling lost-device recovery — takes planning. It also works best as part of a broader zero trust approach. That is the kind of work a managed cyber security partner handles end to end.
Related services
See our cyber security services and Microsoft 365 management, or book a free IT assessment to review your identity security. Questions? Contact our Sydney team.
Frequently asked questions
Multi-factor authentication requires two or more separate proofs of identity before granting access — typically something you know (a password) combined with something you have (a phone or security key) or something you are (a fingerprint or face). This means a stolen password alone is not enough to sign in.
Two-factor authentication (2FA) is a type of MFA that uses exactly two factors. MFA is the broader term covering any use of two or more factors. In everyday business use the terms are often used interchangeably.
SMS MFA is far better than no MFA, but it is the weakest common method. Text codes can be intercepted through SIM-swap fraud or phishing. Where possible, use an authenticator app or, better still, phishing-resistant methods like passkeys or FIDO2 security keys.
Phishing-resistant MFA uses cryptographic methods — such as passkeys, FIDO2 security keys or certificate-based authentication — that cannot be tricked into approving a login on a fake website. Unlike codes or push prompts, the credential is bound to the real site and cannot be relayed by an attacker.
Yes. Microsoft 365 and Microsoft Entra ID include MFA, and security defaults or Conditional Access can enforce it for all users at no extra licensing cost for the basic feature. Advanced controls sit in the Entra ID P1 and P2 tiers.