MFA (multi-factor authentication) requires a user to present two or more independent factors before access is granted. The classic factors are something you know (password), something you have (phone or security key) and something you are (fingerprint or face).
Why it matters
Attackers can usually obtain one factor, but obtaining several independent ones is much harder. Organizations enable MFA for email, admin panels, VPNs and cloud consoles because those accounts guard everything else. Two-factor authentication is simply MFA with exactly two factors.
Example
A cloud console login: enter your password, then confirm a prompt in an authenticator app, then touch a hardware security key for sensitive actions such as deleting a database.
Common mistakes
- Counting two things from the same category, such as a password plus a security question, as two factors.
- Exempting admin or service accounts from MFA, leaving the most valuable targets weakest.
- Leaving weak recovery paths, such as email reset without MFA, that bypass the whole system.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.