The factors come from different categories: something you know, such as a password; something you have, such as a phone or security key; and something you are, such as a fingerprint. After entering a password, the user approves a prompt, types a short code from an authenticator app, or taps a key. A stolen password alone is then not enough to sign in.
Passwords are stolen constantly through phishing, reused logins, and data breaches at other companies. MFA means a stolen password is no longer enough to get in, which makes it one of the most effective low-cost security steps a small business can take. It is built into Microsoft 365 and Google Workspace, and it is part of both Cyber Essentials and the Essential Eight.
Not all methods are equal. Codes sent by text message are better than nothing but can be intercepted, and push prompts can be approved by a user worn down by repeated requests. Authenticator apps with number matching, passkeys, and security keys are stronger. Cover every account, especially administrators and email, and plan for lost phones. We turn on and enforce MFA when setting up Microsoft 365 and Google Workspace.