# Multi-factor authentication (MFA)

> Multi-factor authentication (MFA) is a sign-in method that requires two or more different kinds of proof, such as a password plus a code from a phone app or a physical security key, before it grants access to an account.

Also called: MFA, two-factor authentication, 2FA, two-step verification.

The factors come from different categories: something you know, such as a password; something you have, such as a phone or security key; and something you are, such as a fingerprint. After entering a password, the user approves a prompt, types a short code from an authenticator app, or taps a key. A stolen password alone is then not enough to sign in.

Passwords are stolen constantly through phishing, reused logins, and data breaches at other companies. MFA means a stolen password is no longer enough to get in, which makes it one of the most effective low-cost security steps a small business can take. It is built into Microsoft 365 and Google Workspace, and it is part of both Cyber Essentials and the Essential Eight.

Not all methods are equal. Codes sent by text message are better than nothing but can be intercepted, and push prompts can be approved by a user worn down by repeated requests. Authenticator apps with number matching, passkeys, and security keys are stronger. Cover every account, especially administrators and email, and plan for lost phones. We turn on and enforce MFA when setting up Microsoft 365 and Google Workspace.

## Where we do this work

- [Cybersecurity services](https://techpitsolutions.systems/services/cybersecurity)
- [Microsoft 365 and Google Workspace setup](https://techpitsolutions.systems/services/microsoft-365-google-workspace-setup)

## See also

- [Phishing](https://techpitsolutions.systems/glossary/phishing): Phishing is a type of fraud in which an attacker sends a message that pretends to come from a trusted sender in order to trick the recipient into revealing passwords, approving payments, or opening a malicious link or file.
- [Zero trust](https://techpitsolutions.systems/glossary/zero-trust): Zero trust is a security approach that never assumes a user or device is safe just because it is inside the company network. Every access request is checked against identity, device health, and permissions before it is allowed.
- [Cyber Essentials](https://techpitsolutions.systems/glossary/cyber-essentials): Cyber Essentials is a UK government-backed certification scheme that sets out five basic technical controls, covering firewalls, secure configuration, security updates, user access control, and malware protection, to guard against common online attacks.
- [Essential Eight](https://techpitsolutions.systems/glossary/essential-eight): The Essential Eight is a set of eight baseline cybersecurity strategies published by the Australian Signals Directorate to help organizations protect internet-connected IT networks against common cyber threats.

---

Source: https://techpitsolutions.systems/glossary/multi-factor-authentication

TechPit Solutions · Run by AI, backed by real people. A remote team working with businesses in the US, UK, Canada, Australia, New Zealand and Europe. Email info.techpit.co@gmail.com, WhatsApp +92 344 3360585. Book a 15-minute call: https://techpitsolutions.systems/contact