Protect email and cloud suites
Stop mailbox takeovers that then fraud customers and suppliers.
What is MFA? Definition, factors, and good practice
MFA (Multi-Factor Authentication) requires a user to prove identity with at least two factors of different types—typically something they know (password), something they have (phone, hardware key), or something they are (biometrics). It sharply reduces the chance that a stolen or guessed password alone opens an account. NIST SP 800-63B guidelines define authenticator types and assurance levels for digital authentication.
In one sentence
MFA stops a single compromised password from unlocking your systems.
Key points
- Two factors from different categories beat a second weak “secret.”
- Authenticator apps and FIDO2/passkeys resist phishing better than SMS.
- Cover email, VPN, cloud admin, and privileged accounts—not only HR portals.
- NIST SP 800-63B defines assurance levels (AAL) by service sensitivity.
Term at a glance
- MFA
- Multi-Factor Authentication · Authentification multifacteur · 2FA · Two-factor authentication
- French term
- Authentification multifacteur
- Domain
- Cybersecurity / identity
- Category
- Access control
- Level
- Beginner to intermediate
What does multi-factor authentication mean in practice?
A single factor—almost always the password—remains the most common path into business accounts. MFA adds a second proof at sign-in or for sensitive actions. Without it, a leaked credential (phishing, sold dump, credential stuffing) is often enough to get in.
Not all second factors are equal. SMS codes can be intercepted (SIM swap, interception). TOTP apps or push notifications already improve the situation. Cryptographic authenticators (security keys, passkeys) offer far stronger phishing resistance, aligned with higher NIST assurance levels.
Rolling out MFA is more than flipping a switch in the identity provider. You need enrollment, lost-device recovery, service-account exceptions, and documented break-glass paths. In Quebec, protecting access to systems that process personal information is part of reasonable security practice.
How do you deploy MFA effectively?
- 01
Map critical access
Email, Microsoft 365 / Google Workspace, VPN, cloud consoles, ERP, admin tools: cover these first—before secondary apps.
- 02
Choose methods that match risk
Prefer authenticator apps, push, or hardware keys / passkeys; keep SMS only when no alternative exists, knowing its limits.
- 03
Enroll and train users
Phased activation, short guides, lost-device recovery via IT, and extra checks for privileged accounts.
- 04
Monitor and harden
Alert on repeated failures, remove lasting bypasses, and extend MFA to new SaaS through SSO.
A concrete MFA example
A Montreal accounting firm enables MFA on Microsoft 365 after a phishing wave. A partner still clicks a fake link and enters their password—but the attacker lacks the authenticator-app second factor. Sign-in fails; IT resets the password and coaches the team. Without MFA, mailboxes and client files could have been exfiltrated the same day.
What is MFA used for?
Secure remote access (VPN / RDP)
Keep a stolen password from opening the internal network from the internet.
Harden administrator accounts
Require a strong second factor before privileged actions on servers or cloud tenants.
Meet customer and insurer expectations
MFA appears in most cyber questionnaires and many policy conditions.
Benefits and limits of MFA
- Dramatically cuts password-only account takeovers
- Relatively fast to enable on modern cloud suites
- Improves posture for customers and insurers
- Aligns with NIST authentication guidance
- User friction if rollout is poorly prepared
- SMS and some out-of-band channels remain phishable
- Service accounts and legacy apps need exceptions
- Push fatigue if too many apps sit outside SSO
How is MFA different from 2FA?
| MFA | 2FA (two-factor authentication) | |
|---|---|---|
| Number of factors | At least two; can require more | Exactly two factors |
| Common usage | Preferred term in standards (NIST) | Consumer term, often used as synonym |
| Factor quality | Stresses distinct categories (know / have / are) | Sometimes misapplied (two passwords ≠ 2FA) |
| SME practice | Same project: strong second factor everywhere critical | Often the marketing label for the same control |
Why MFA matters for a Quebec SME
Most costly SME incidents start with a compromised mailbox or VPN account. MFA is one of the best effort-to-protection controls: it slows ransomware, invoice fraud, and client-file theft. It is also a frequent RFP and cyber-insurance requirement—delaying it means accepting outsized risk.
Frequently asked questions
Is SMS acceptable as MFA?
Better than nothing, but weaker than TOTP, push, or hardware keys. NIST and current practice push migrating off SMS when possible.
Does MFA replace a strong password?
No. It complements the password (or another factor). A password manager is still recommended.
What if an employee loses their phone?
Plan one-time recovery codes, an IT re-enrollment process, and ideally a backup authenticator.
Do you need MFA on every tool?
Prioritize email, central identity (SSO), VPN, and admin consoles first; then extend via SSO to avoid multi-app fatigue.
Related terms
Sources and references
Want MFA on critical access without locking out your team?
Talk about authentication