Glossary
MFA (multi-factor authentication)
Also called: Two-factor authentication, 2FA, two-step verification
In one sentence
MFA means signing in with something you know (a password) plus something you have or are (a phone app, security key or fingerprint), so a stolen password alone isn't enough.
Passwords get stolen all the time — through phishing emails, data breaches at other websites and reused passwords. Multi-factor authentication adds a second check that an attacker on the other side of the world doesn't have: an approval in an authenticator app on your phone, a code, a hardware security key, or a fingerprint or face scan.
Not all MFA is equal. Text-message codes are better than nothing but can be intercepted or redirected through SIM swapping. App-based approvals with number matching (like Microsoft Authenticator) are much stronger. Phishing-resistant methods — passkeys, Windows Hello for Business and FIDO2 security keys — are strongest, because there's no code for a fake website to capture.
Why it matters: CISA calls MFA one of the most effective steps an organization can take, and cyber insurers now commonly refuse coverage without it on email, remote access and admin accounts. For a medical or dental practice, MFA on Microsoft 365 and any remote access is one of the cheapest, highest-impact protections for patient data, and the proposed HIPAA Security Rule update would make it an explicit requirement.
Example: an office manager types her Microsoft 365 password into a convincing fake “shared document” page. With MFA required, the attacker's sign-in attempt pops up an approval request she didn't expect. She denies it, reports it, and the password is changed before anything happens. Pairing MFA with conditional access closes the remaining gaps.
See our MFA guide for how to roll it out without frustrating staff.
Related terms
- Conditional AccessConditional Access is the Microsoft Entra ID feature that decides, at every sign-in, whether to allow, block or require extra checks based on who is signing in, from what device, and from where.
- PasskeyA password replacement that signs you in with your device’s fingerprint, face or PIN, using cryptography that can’t be phished.
- PhishingPhishing is a scam message — usually an email, but also texts and phone calls — designed to trick someone into handing over a password, opening malware or sending money.
- Microsoft Entra IDMicrosoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud identity service — the system that holds your users' accounts and controls how they sign in to Microsoft 365 and other apps.
- Password managerAn encrypted app that creates, stores and fills in strong, unique passwords, so staff don’t have to remember or reuse them.
- SSO (single sign-on)Signing in once with one strong company account to reach many different apps, instead of a separate password for each.