Multifactor authentication (MFA) verifies identity using more than one type of evidence, such as a password and a device the user possesses.
What does this mean in practice?
An additional factor makes it harder to gain access with a stolen password alone. Available methods and sign-in policies depend on the environment’s configuration.
Example use case
An employee signs in to their work account and verifies their identity using the configured method. The team receives enrolment instructions and knows how to get help if a device is lost.
Things to consider
MFA is one part of your security controls, not a guarantee of complete protection. Permissions, up-to-date recovery details and safe handling of suspicious authentication prompts also matter.
Related terms
See also: Microsoft 365 administration.