What Is Multi-Factor Authentication (MFA) and Why Does It Matter?
A second proof of identity beyond the password. It stops most account takeovers.
Multi-factor authentication (MFA) requires a second proof of identity in addition to a password, such as a code from an app, a push notification to your phone or a physical security key. It blocks the large majority of account takeover attempts, because a stolen password alone is no longer enough to get in.
Why passwords alone fail
Passwords get phished, reused across sites, and leaked in breaches of other companies. Attackers buy those lists and try them against business email and remote access. Without MFA, one leaked password from a shopping site can open your Microsoft 365 tenant.
The types of second factor
- Authenticator app (Microsoft Authenticator, similar) with number matching. The recommended default.
- Push notification to a registered phone.
- Hardware security key (FIDO2), the strongest option, good for administrators and executives.
- SMS text codes. Better than nothing, but vulnerable to SIM swapping; use only as a fallback.
Where MFA must be enforced
Email and Microsoft 365, remote access and VPN, cloud applications, banking and payroll portals, password managers, and every administrator account. "Enforced" means required by policy, not merely available. In Microsoft 365, that is done with Conditional Access; see what is conditional access and what is Entra ID.
MFA fatigue and phishing-resistant MFA
Attackers now spam push notifications hoping someone taps approve, and build fake login pages that relay codes in real time. Number matching, limiting prompts, and moving high-risk users to security keys address this.
Insurance and compliance
MFA on email, remote access and admin accounts is the first question on nearly every cyber insurance application. See the cyber insurance requirements checklist. Pair it with a password manager so the first factor is strong too.
Unified MFA is included in every Mentis Group Fully Managed IT plan and is a foundation of our Enhanced Cybersecurity program.
Have a question about your own environment? Schedule a consultation with Mentis Group or call (866) 901-7808.