Multi-Factor Authentication (MFA)

We recommend reviewing more than whether MFA is technically enabled. A proper assessment should examine MFA coverage, excluded users, authentication methods, privileged accounts, legacy authentication, on-premises access and scenarios where MFA can potentially be bypassed.

The result should provide a clear view of both existing protection and remaining authentication gaps.

Start by understanding your authentication landscape. Identify which users, administrators, applications and systems still rely on password-only authentication.

From there, prioritise privileged accounts and high-impact systems before expanding the approach across the broader environment.

Increasingly, yes. Modern authentication technologies such as passkeys and hardware-backed authentication allow organisations to move towards passwordless authentication.

However, most organisations will transition gradually because existing applications and infrastructure may still depend on passwords.

It can if it is implemented poorly. A good MFA strategy avoids unnecessary prompts and uses context to determine when additional authentication is required.

The objective is stronger security with as little disruption as possible.

Legacy applications do not always need to be replaced immediately. In many situations, MFA can be introduced at another layer of the authentication process or through an identity security control in front of the application.

The appropriate approach depends on how the application authenticates users.

Yes. Many organisations initially introduce MFA for cloud applications but continue to have important on-premises authentication paths.

Depending on the application and authentication method, additional controls can often be introduced to protect access to servers, applications, remote access and other on-premises resources.

Phishing-resistant authentication uses methods that are designed to prevent users from accidentally providing authentication information to a fraudulent website or attacker.

Examples include hardware-backed security keys, passkeys and certificate-based authentication.

These approaches provide significantly stronger protection than traditional password and approval-based authentication.

Yes. Privileged identities are particularly valuable to attackers and should receive stronger protection.

Organisations should consider phishing-resistant authentication methods and additional access controls for administrative accounts.

MFA should generally protect all users, but authentication requirements do not necessarily need to be identical for every situation.

The level of authentication can depend on factors such as the user, application, device, location, privilege level and risk associated with the login.

MFA significantly improves account security, but it should not be considered a complete identity security solution. Attackers can still use techniques such as phishing, session theft, MFA fatigue and attacks against legacy authentication.

Strong MFA should therefore be combined with identity monitoring, access policies, device security and secure authentication methods.

Multi-Factor Authentication requires users to provide more than one form of verification before access is granted. Instead of relying only on something the user knows, such as a password, authentication can also use something the user has or something that uniquely verifies the user.

This significantly reduces the risk associated with stolen passwords.