Why are more login attempts requiring a code from your phone? Why are you asked for your face ID or fingerprint on your mobile device?  These are examples of the highly effective security technology, multifactor authentication.

In this article, we will help you to understand what multifactor authentication (MFA) is, how MFA works from both the IT admin’s and users’ perspectives, and the benefits of multiple authentication factors in technology.

Multifactor authentication (MFA) is sometimes referred to as two-factor authentication (2FA). Technically, two-factor authentication is a subset of MFA, which uses two or more factors. In practice, though, they often refer to the same thing.

Multi-factor authentication can include more than two authentication methods.

Multifactor authentication is a security technology that uses two or more authentication factors to verify a user’s identity when logging into a secure service.

MFA methods can include:

• Something you know, like your password, passphrase or personal identification number (PIN)

• Something you have, like your smartphone, smart card, or security token

• Something you are, also known as a biometric, like your fingerprint, face, voice, or retina

MFA is an important tool for preventing unauthorized access to your accounts, ensuring only those you choose can gain access. Microsoft reports that the chances of an account been compromised is reduced by 99.9% by using multifactor user authentication (MFA).

Now that we have a better understanding of the factors involved in MFA, let’s learn how it works.

In a traditional login experience, a user enters their username and password. This gets verified by the system, and if correct, the system grants the user secure access.

The risk with this, however, is that if hackers obtain the user ID and password, they can easily access your machine or network. Passwords are notoriously unsecure. People use the same passwords across multiple accounts, they develop easily cracked patterns, and many use variations of common password logins.

MFA, on the other hand, goes beyond the username and password with additional factor(s) to prevent common password hacks.

Typical MFA Sign-in Process

This not the only method of MFA, but it is the most common.

1. 1. The user logs in by typing in user ID and password
   2. Then the system will verify the credentials
   3. If successful, the system will prompt the user for a secondary factor
      • Most commonly, this is a One Time Passcode (OTP) or push notification sent to the user’s phone
      • This may be delivered by SMS text message or via an authenticator app
   4. Once the OTP is entered, or the push notification is accepted, the system will then grant access
   5. If the OTP is entered incorrectly, or the push notification is denied, the system will deny access

MFA from the perspective of the IT admin

In a business environment, it’s the IT admin’s responsibility to enable multifactor authentication for sensitive applications and/or accounts. Most services allow admins to enable MFA from an admin control panel. Because MFA is so effective, we recommend enabling it wherever possible in your organization.

Before instituting MFA across the organization, though, it’s important to educate users on what to expect. MFA adds one additional step to your user’s workflow. Without proper education, users may find it to be an annoying roadblock to their workday.

Managing MFA across systems and across the organization can become difficult. We recommend adopting a centralized MFA App like Duo Mobile. This provides all users with a one-stop MFA app that can be used across every program that requires MFA.

MFA from the Perspective of the User’s Identity

From the user’s perspective, they’ll see one additional prompt after entering their username and password. The prompt will ask for the One Time Passcode or approval of the push notification.

If your organization uses an MFA app, that app on the user’s smartphone will provide the code or push notification. If your organization does not a single MFA app, the MFA method will depend on what is being accessed.

Without a centralized MFA app, users often end up with multiple apps. This can make it hard to remember which app to use for each account.

Now that we know how multifactor authentication works, let’s look at the benefits of MFA.