--- title: "Multi-Factor Authentication — Identity Glossary | IDSync" description: "Multi-factor authentication (MFA) requires a user to present two or more independent factors — something they know, have, or are — before being granted access." lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://idsync.com/" }, { "@type": "ListItem", "position": 2, "name": "Glossary", "item": "https://idsync.com/glossary" }, { "@type": "ListItem", "position": 3, "name": "Multi-Factor Authentication", "item": "https://idsync.com/glossary/multi-factor-authentication" } ] }, { "@context": "https://schema.org", "@type": "DefinedTerm", "@id": "https://idsync.com/glossary/multi-factor-authentication", "name": "Multi-Factor Authentication", "alternateName": [ "MFA", "MFA", "2FA", "Two-factor authentication" ], "description": "Multi-factor authentication (MFA) requires a user to present two or more independent factors — something they know, have, or are — before being granted access.", "url": "https://idsync.com/glossary/multi-factor-authentication", "inDefinedTermSet": "https://idsync.com/glossary" }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is a password + a security question MFA?", "acceptedAnswer": { "@type": "Answer", "text": "Technically no — both are knowledge factors. NIST and most auditors don't count it." } }, { "@type": "Question", "name": "Should I move from TOTP to passkeys?", "acceptedAnswer": { "@type": "Answer", "text": "For high-value access and for any workforce that handles real money or data, yes. For consumer apps, offering passkeys as a faster, more secure alternative is increasingly table stakes." } }, { "@type": "Question", "name": "What is adaptive MFA?", "acceptedAnswer": { "@type": "Answer", "text": "A policy that decides *when* to require MFA based on context: new device, unusual location, accessing a sensitive resource, or a high risk score. Reduces user friction without weakening security." } } ] } ] --- [![IDSync — identity software buyer platform](/assets/idsync-logo-BKS89EW4.png)](/) [Directory](/directory) [Compare](/compare) [Resources](/resources) [Browse tools](/directory)[Run Stack Finder](/stack-finder) 1. [Home](/) 2. [Glossary](/glossary) 3. Multi-Factor Authentication Authentication # Multi-Factor Authentication (MFA) Multi-factor authentication (MFA) requires a user to present two or more independent factors — something they know, have, or are — before being granted access. Last reviewed 3 months ago Key points - The three classic factor categories: knowledge (password), possession (phone, security key), inherence (biometric). - Not all MFA is equal — SMS and TOTP are phishable; passkeys and FIDO2 hardware keys are phishing-resistant. - CISA, NIST, and most cyber insurers now distinguish 'phishing-resistant MFA' as the only acceptable form for high-value access. - MFA fatigue / push bombing attacks have made push-based MFA without number matching risky. - Adaptive MFA only prompts for additional factors based on risk signals (new device, impossible travel, sensitive resource). ## What is MFA? Multi-factor authentication (MFA) is the requirement that a user present two or more **independent factors** before being granted access. The classic three categories from NIST SP 800-63: 1. **Knowledge** — something you know (password, PIN, answer to a security question). 2. **Possession** — something you have (phone, security key, smart card). 3. **Inherence** — something you are (fingerprint, face, voice). Two-factor authentication (2FA) is just MFA with exactly two factors. The terms are used interchangeably. ## Why MFA matters Microsoft has reported that MFA blocks more than 99% of automated account compromise attempts. Almost every major breach in the last decade traces back to either no MFA or weak MFA. Cyber insurance, SOC 2, HIPAA, PCI-DSS 4.0, and most enterprise procurement checklists now require MFA for privileged and remote access. But "MFA enabled" is no longer enough. Attackers have adapted: - **SMS interception and SIM swap** defeats SMS-based codes. - **Adversary-in-the-middle (AiTM)** proxies like Evilginx defeat TOTP and most push approvals. - **MFA fatigue / push bombing** spams the user with push notifications until they accidentally approve. This is why CISA and NIST now talk about **phishing-resistant MFA** as a separate category. ## MFA factor strength, ranked From weakest to strongest: 1. **SMS / voice OTP** — phishable, SIM-swappable. Better than nothing, not acceptable for privileged access. 2. **TOTP apps (Google Authenticator, Authy)** — phishable via AiTM, but immune to SIM swap. 3. **Push notification (basic)** — vulnerable to push bombing. 4. **Push with number matching** — significantly harder to fatigue-attack. 5. **Passkeys / FIDO2 security keys** — phishing-resistant by design. The gold standard. ## When buyers care You need MFA — and increasingly, phishing-resistant MFA — when: - You're running anything resembling Zero Trust. - Your cyber insurance renewal asks for it (most do now). - You're handling PHI, payment data, or customer PII. - You have privileged accounts that can move money or access production data — see [PAM](/glossary/pam). - You're a SaaS vendor whose enterprise buyers will refuse to deploy without MFA support. ## Common pitfalls - **Allowing SMS as the only second factor** for privileged accounts. - **Self-service MFA reset via help desk** — a major social engineering vector. Require step-up verification. - **No fallback path** — when the only registered factor is a lost phone, recovery becomes a help-desk security hole. - **Treating SSO as MFA.** SSO concentrates risk; MFA at the IdP is what makes it safe. ## FAQ ### Is a password + a security question MFA? Technically no — both are knowledge factors. NIST and most auditors don't count it. ### Should I move from TOTP to passkeys? For high-value access and for any workforce that handles real money or data, yes. For consumer apps, offering passkeys as a faster, more secure alternative is increasingly table stakes. ### What is adaptive MFA? A policy that decides _when_ to require MFA based on context: new device, unusual location, accessing a sensitive resource, or a high risk score. Reduces user friction without weakening security. ## Standards & references - [NIST SP 800-63B — Digital Identity Guidelines](https://pages.nist.gov/800-63-3/sp800-63b.html) - [CISA guidance on phishing-resistant MFA](https://www.cisa.gov/resources-tools/resources/implementing-phishing-resistant-mfa) IDSync provides educational buyer guidance based on publicly available information, editorial review, and user-submitted data. Vendor information should be verified before purchase. [Who we are, our methodology & disclosure policy](/about). ### One identity concept, explained per issue Get vendor-neutral identity explainers and market updates in your inbox. Work email\* Name Company Role (optional) Interests (optional) Pick what you want more of. IAMCIAMSSO/MFAIGA/PAMSCIM/provisioningAI agent identityVendor updatesSecurity incidents Subscribe Twice-monthly identity digest. Curated, vendor-neutral. Unsubscribe any time. ### Vendor categories [mfa](/directory/category/mfa)[iam platforms](/directory/category/iam-platforms)[ciam](/directory/category/ciam) ### Related terms [passkeys](/glossary/passkeys)[fido2](/glossary/fido2)[phishing resistant mfa](/glossary/phishing-resistant-mfa)[totp](/glossary/totp)[passwordless](/glossary/passwordless) ### Not sure which tool you need? Run the IAM Stack Finder for a vendor-neutral shortlist tailored to your stack. [Run the Stack Finder](/stack-finder) ### Explore tools for this topic Browse vetted vendors in the mfa category. [Explore tools](/directory/category/mfa) [![IDSync home](/assets/idsync-logo-BKS89EW4.png)](/) The buyer-focused platform for identity, access, and authentication software. #### Platform - [Home](/) - [IAM Stack Finder](/stack-finder) - [Directory](/directory) - [Resources](/resources) - [State of AI Agent Identity 2026](/reports/state-of-ai-agent-identity-2026) - [Buyer Guides](/guides) - [Glossary](/glossary) - [Newsletter](/newsletter) - [Newsletter Archive](/newsletter/archive) #### Best of guides - [All comparisons](/compare) - [All vendor alternatives](/alternatives) - [Best SSO tools](/compare/best-sso-tools) - [Best MFA tools](/compare/best-mfa-tools) - [Best PAM tools](/compare/best-pam-tools) - [Best IGA tools](/compare/best-iga-tools) - [Best CIAM tools](/compare/best-ciam-tools) - [Best passwordless auth](/compare/best-passwordless-authentication-tools) - [Best identity security](/compare/best-identity-security-tools) - [Best machine identity](/compare/best-machine-identity-tools) - [Best SaaS access governance](/compare/best-saas-access-governance-tools) - [Best developer auth](/compare/best-developer-authentication-tools) - [Best for startups](/compare/best-iam-tools-for-startups) - [Best for enterprises](/compare/best-iam-tools-for-enterprises) - [Best SCIM tools](/compare/best-scim-provisioning-tools) - [Best for AI agents](/compare/best-ai-agent-identity-tools) - [Best NHI tools](/compare/best-nhi-management-tools) - [Okta pricing explained](/guides/okta-pricing) - [Auth0 pricing explained](/guides/auth0-pricing) - [Okta alternatives](/alternatives/okta) - [Auth0 alternatives](/alternatives/auth0) #### For Vendors - [Sponsor](/sponsor) - [Badges](/badges) - [Submit Product](/submit-product) - [Claim Profile](/claim-profile) - [Partner](/partner) #### Company - [About & Methodology](/about) - [Contact](/contact) - [Privacy](/privacy) Vendor names, logos, and trademarks are the property of their respective owners. IDSync is an independent buyer resource and does not imply endorsement unless explicitly stated. Logos are displayed for identification purposes only. IDSync (idsync.com) is operated by TetraCore, Bowling Green, Ohio. It is not affiliated with the IDSync® Active Directory synchronizer by Identity Syncronizer — [learn more](/about#idsync-disambiguation). © 2026 IDSync. All rights reserved. Editorial independence. Sponsored placements are clearly disclosed.