IT Security: Multi-Factor Authentication (MFA) Setup (2024)

FAQs

What is multi-factor authentication MFA and how does it work? ›

Multi-factor authentication (MFA) is a multi-step account login process that requires users to enter more information than just a password. For example, along with the password, users might be asked to enter a code sent to their email, answer a secret question, or scan a fingerprint.

Applications, unlike browsers, have a 90 day rolling token. This means that you should not be asked to verify with MFA if you use an app more frequently than every 90 days. Any changes that cause you to login again, such as a password change, will trigger MFA verification.

Factors include: (i) something you know (e.g. password/personal identification number (PIN)); (ii) something you have (e.g., cryptographic identification device, token); or (iii) something you are (e.g., biometric).

Microsoft Entra multifactor authentication works by requiring two or more of the following authentication methods: Something you know, typically a password. Something you have, such as a trusted device that's not easily duplicated, like a phone or hardware key.

To check MFA status of your users,

Choose Identity from the menu, then go to Users and select All Users. Click on the Per-user MFA option among the choices listed above. You will be directed to the multi-factor authentication page, where you can view the MFA status of all your users.

Beware of MFA fatigue attacks.

Fraudsters can often buy your personal data, including your passwords, on the dark web. Armed with your password, attackers may bomb you with push MFA authentication requests. The goal is to get you to accept the notification so they can gain access to the account.

MFA allows a user to use more than one type of authentication method, whereas 2FA only allows you to add one type of authentication factor on top of your username and password. Because you can implement several types of authentication factors with MFA, it makes it a more secure solution to 2FA.

At the end of your 90-day period, MFA will take effect for all your users. That means disruption is a big risk if you don't have MFA enabled. A day will come when everyone goes to log in and they're suddenly being told they need to download an app, set up their account on the app, get a code, etc.

Admins will always be prompted for MFA on login. Users will be prompted for MFA "when necessary" (this is not strictly defined by Microsoft but includes when users show up on a new device or app, and for critical roles and tasks). Access to Azure portal, Azure CLI or Azure PowerShell by anyone will always require MFA.

Biometric and possession-based authentication factors may be the strongest means of securing a network or application against unauthorized access. Combining these methods into a multifactor authentication process decreases the likelihood of a hacker gaining unauthorized access to the secured network.

What is the most secure MFA? ›

Most Secure: Hardware Keys

External hardware keys, like Yubikeys, are among the strongest authentication factors available. Also called FIDO keys, they generate a cryptographically secure MFA authentication code at the push of a button.

One of the most common forms of multi-factor authentication is referred to as "something you know." Oftentimes, this is a one-time password or PIN that's sent to your personal device, typically via text message or, more securely, through an authenticator app.

To register your device for use with MFA

Sign in to your AWS access portal. For more information, see Signing in to the AWS access portal. Near the top-right of the page, choose MFA devices. On the Multi-factor authentication (MFA) devices page, choose Register device.