What is: Multifactor Authentication - Microsoft Support (2024)

When you sign into your online accounts - a processwe call "authentication" - you're proving to the service that you are who you say you are. Traditionally that's been done with a username and a password. Unfortunately, that's not a very good way to do it. Usernames are often easy to discover; sometimes they're just your email address. Since passwords can be hard to remember, people tend to pick simple ones, or use the same password at many different sites.

That's why almost all online services -banks,social media, shopping and yes, Microsoft 365 too - have added a way for your accounts to be more secure. You may hear it called "Two-Step Verification" or "Multifactor Authentication" but the good ones all operate off the same principle. When you sign into the account for the first time on a new device or app (like a web browser) you need more than just the username and password. You need a second verification method - what we call a second "factor" - to prove who you are.

What is: Multifactor Authentication - Microsoft Support (1)

A factor in authentication is a way of confirming your identity when you try to sign in. Forexample,a password is one kind offactor, it's a thing you know. The three most common kinds of factors are:

Something you know - Like a password, or a memorized PIN.
Something you have - Like a smartphone, or a secure USB key.
Something you are - Like a fingerprint, or facial recognition.
See Also
Types of Multi-Factor Authentication (MFA)Which of the following is an example of multi-factor authentication?Multi-factor Authentication - SY0-601 CompTIA Security+ : 2.4 - Professor Messer IT Certification Training Courses Passkeys are ready to meet Australia's evolving MFA standards: Navigating Essential Eight and FSC Standard No. 29

How does multifactor authentication work?

Let's say you're going to sign into your Microsoft account or work or schoolaccount,and you enter your username and password. If that's all you need then anybody who knows your username and password can sign in as you from anywhere in the world!

But if you have multifactor authentication enabled, things get more interesting. The first time you sign in on a device or app you enter your username and password as usual, then you get prompted to enter your second factor to verify your identity.

Perhaps you're using the Microsoft Authenticator app as your second factor. You open the app on your smartphone, it shows you a unique, dynamically created6-digitnumber that you type into the siteand you're in.

If somebody else tries to sign in as you, however, they'llenter your username and password, and when they get prompted for that second factor they're stuck! Unless they have YOURsmartphone,they have no way of getting that6-digitnumber to enter. And the 6-digitnumber in Microsoft Authenticator changes every 30 seconds, so even if they knew the number you used to sign in yesterday,they're still locked out.

Important things to know

You won't have to do the second stepvery often. Some people worry that multifactor authentication is going to be really inconvenient, but generally it's only used the first time you sign into an app or device, or the first time you sign in after changing your password. After that you'll just need your primary factor, usually a password, like you do now.

The extra security comes from the fact that somebody trying to break into your account is probably not using yourdevice,so they'll need to have that second factor to get in.

Multifactor authentication is not just for work or school. Almost every online service from your bank, to your personal email, to your social media accounts supports adding a second step of authentication and you should go into the account settings for those services and turn that on.

Click here to turn two-step verification on for your personal Microsoft Account
Click here if you're an IT Pro or administrator and you want to know how to enable multifactor authentication for Microsoft 365

Compromised passwords are one of the most common ways that bad guys can get at your data, your identity, or your money. Using multifactor authenticationis one of the easiest ways to make it a lot harder for them.

Learn more

The keys to the kingdom - securing your devices and accounts

Create and use strong passwords

FAQs

What is: Multifactor Authentication - Microsoft Support? ›

See What is: Multifactor authentication. By setting up MFA, you add an extra layer of security to your Microsoft 365 account sign-in. For example, you first enter your password and, when prompted, you also type a dynamically generated verification code provided by an authenticator app or sent to your phone.

Read On ›

What triggers Microsoft MFA? ›

Microsoft Entra multifactor authentication works by requiring two or more of the following authentication methods: Something you know, typically a password. Something you have, such as a trusted device that's not easily duplicated, like a phone or hardware key.

Discover More Details ›

Is Microsoft forcing MFA 2024? ›

Enforcement for the MFA requirement at Azure sign-in will be rolled out in phases: Phase 1: Starting in July 2024, enforcement for MFA at sign-in for Azure portal only will roll out gradually to all tenants. This phase will not impact any other Azure clients, such as Azure CLI, Azure PowerShell and IaC tools.

What does multifactor authentication explain about? ›

Multi-factor authentication acts as an additional layer of security to prevent unauthorized users from accessing these accounts, even when the password has been stolen. Businesses use multi-factor authentication to validate user identities and provide quick and convenient access to authorized users.

See Details ›

Should you enable MFA? ›

Using MFA protects your account more than just using a username and password. Users who enable MFA are significantly less likely to get hacked.

Find Out More ›

Is Microsoft MFA mandatory? ›

Required MFA for all Azure users will be rolled out in phases starting in the 2^nd half of calendar year 2024 to provide our customers time to plan their implementation: Phase 1: Starting in October, MFA will be required to sign-in to Azure portal, Microsoft Entra admin center, and Intune admin center.

Tell Me More ›

How do I know if Microsoft MFA is enabled? ›

Sign-in to the Microsoft Entra admin center. Go to All Users residing under Identity»Users and select Per-user MFA. Now, you'd be redirected to the multi-factor authentication page. In the list of users, view the multi-factor authentication status field to see the current MFA status for each user.

Show Me More ›

What is the most common example of multifactor authentication? ›

Examples of multi-factor authentication in action

Something you know, such as a password, passphrase or personal identification number (PIN)
Something you have, such as a token or smartcard.
Something you are, such as a biometric like a fingerprint.

Oct 29, 2021

Explore More ›

How does Microsoft multi-factor authentication work? ›

What are 3 reasons multi-factor authentication should be used? ›

Reduced Costs. An attack on your network can be costly. ...
Improved Trust. Users–especially customers–will feel more secure overall using a second method of authentication before accessing their data, knowing there is extra security keeping their information secure. ...
Easier Logins.

Show Me More ›

Which option should be avoided in MFA? ›

Factors that rely on your phone number, such as SMS and phone calls should be avoided if possible as they are the least secure and provide the worst user experience.

Read The Full Story ›

How safe is multi-factor authentication? ›

Multifactor authentication is still a secure method for protecting your account, but it's not without risks. It's wise to educate yourself about SIM swapping, man-in-the-middle attacks and other fraudulent activity and take steps to protect your personal information.

See Details ›

When should you use multifactor authentication? ›

Some people worry that multifactor authentication is going to be really inconvenient, but generally it's only used the first time you sign into an app or device, or the first time you sign in after changing your password. After that you'll just need your primary factor, usually a password, like you do now.

Get More Info Here ›

How do you trigger MFA? ›

Turn on MFA for each account or app!

Go to Settings. It may be called Account Settings, Settings & Privacy or similar.
Look for and turn on MFA. It may be called two-factor authentication, two-step authentication or similar.
Confirm. Select which MFA method to use from the options provided by each account or app.

How often does Microsoft prompt for MFA? ›

Every time a user closes and opens the browser, they get a prompt for reauthentication. In Office clients, the default time period is a rolling window of 90 days.

Why does MFA keep popping up? ›

Check the session timeout settings: If the session timeout settings for the web applications are set too low, users may be prompted for MFA more frequently than desired. Check the session timeout settings and increase them if necessary.

View Details ›

What is the reason access requires MFA? ›

MFA Enables Stronger Authentication

It adds another layer of protection from the kinds of damaging attacks that cost organizations millions. A security breach caused by a weak user password would understandably have huge consequences for both the company and the customers who trust it.