Multi-factor authentication

First principles

Authentication asks a person (or a workload) to prove an identity. One factor is something you know: a password, a PIN. A second factor is something you have: a hardware key, a phone token, a passkey bound to a device. Something you are — a biometric — usually unlocks the have, rather than standing alone against a remote service.

MFA means the guess of a password is not enough. It does not mean every second factor is equal. A one-time code typed into a page you did not mean to visit can be relayed. A hardware key or a passkey that will not sign for the wrong origin is phishing-resistant. SMS can be redirected. Prefer the resistant form where the account is worth it.

Where to start

Privileged accounts, remote access, and email. Those three first. An admin portal with a password only is a standing invitation. A VPN or a desktop that lands on the internal network with a password only is the same invitation with a bigger blast radius. Email is how password resets and OAuth grants travel; protect it or the rest unravels.

What an admin actually does

• Turn MFA on for identity providers, email, VPN, cloud consoles, and any admin path, before you argue about staff SaaS.
• Issue hardware keys or platform passkeys to admins. Keep a spare key in a sealed break-glass process.
• SMS is acceptable as a floor, not as the design for privileged users.
• MFA on a shared account is theatre. Shared accounts cannot be enrolled honestly. Give people their own identities.
• Record recovery codes in the password manager, not in the same inbox you just protected.