Passwords are stolen, guessed or entered into phishing forms. Multi-factor authentication ensures a stolen password alone is not enough. It is therefore the most effective single measure against account takeover.
The methods
SMS codes are better than nothing but vulnerable to SIM swapping and phishing. One-time codes from an authenticator app are more secure. Push approvals are convenient but can be forced by repeated prompts when annoyed users approve; number matching in the app reduces this risk. Strongest are phishing-resistant methods: FIDO2 security keys and passkeys, which are cryptographically bound to the genuine website and do not work on a fake page.
Where MFA goes first
All administrator accounts, email and Microsoft 365 or Google Workspace, remote access such as VPN, accounting and e-banking, and all cloud consoles. Administrators should use phishing-resistant methods. Legacy sign-in protocols that bypass MFA must be disabled, otherwise a back door stays open.
Typical gaps
Exceptions for individuals that are never revoked. Service accounts with a password and no second factor. Recovery processes where a call to support is enough to reset MFA. And third-party apps users have granted OAuth access that no longer ask for MFA at all. Our Microsoft 365 security checklist reviews the baseline.