Multi-Factor Authentication (MFA)
Requires two or more independent factors to verify identity — typically a password plus something you have or something you are — instead of a password alone.
A password on its own is a single point of failure — it can be phished, guessed, or leaked in a breach elsewhere and reused. MFA closes that gap by requiring a second, independent factor before granting access: a code from an authenticator app, a push notification to a registered device, or a biometric check.
The strongest forms are phishing-resistant — a physical security key or platform authenticator that can’t simply be relayed to an attacker the way an SMS code can. Weaker forms (SMS-based codes) still beat no MFA at all, but are worth upgrading where the risk justifies it.
MFA is usually enforced through Conditional Access — required only when a sign-in looks risky, rather than every single time.