Key takeaway
Enable MFA for human sign-ins across supported work systems. For administrators, choose FIDO2/WebAuthn with user verification or suitably configured phishing-resistant certificate authentication; protect recovery access too.
Understand factors and methods
MFA requires evidence from two or more independent categories: something you know, something you possess or a biometric characteristic. Two knowledge proofs such as a password and PIN are not two distinct factors. A local PIN or biometric can activate a possession-bound authenticator; that differs from sending two knowledge secrets. Authenticator apps, OTP codes, push prompts, hardware keys and smart cards have different security properties. SMS may reduce some risk, but it is not phishing-resistant and remains vulnerable to phone-number takeover.
Match protection to the account
Require MFA for human sign-ins to email, remote access, cloud administration, financial systems and sensitive data; start with administrators and high-impact accounts. Review enrollment, new-device, session and token policies too.
| Method | Phishing resistance | Deployment consideration |
|---|---|---|
| FIDO2/WebAuthn with user verification | Domain-bound | Supported clients, enrollment and recovery |
| Suitably configured certificate/smart-card authentication | Bound to the authenticated verifier/channel | PKI and supported sign-in |
| OTP or ordinary push, including number matching | Not phishing-resistant | Codes or approvals can be attacked; number matching reduces prompt abuse but does not confer phishing resistance |
Secure recovery and administration
Define approved recovery paths for a lost device; verify helpdesk identity checks, temporary-access expiry and logging of every recovery. Store backup codes securely and avoid relying on one phone number for the whole account. Put an expiry on exceptions and monitor enrollment, failures, resets and bypasses. MFA reduces some password-theft risk, but does not replace permission, endpoint and monitoring controls. Revoke and replace a lost authenticator and notify the user through an established channel.
Distinguish 2FA from other MFA combinations
2FA uses two distinct factor categories, while MFA uses two or more, so 2FA is a subset of MFA. A password plus a one-time code adds a step, but a code can still be phished from a fake sign-in page. FIDO2/WebAuthn helps resist that attack by binding authentication to the relying domain. Check supported factors and protocols in the identity provider documentation and the actual application.