Two-factor authentication adds a second type of evidence when someone signs in. It reduces the risk of a stolen password giving an attacker access to business email, files or applications.
Reviewed 23 October 2026.
The difference between 2FA and MFA
Two-factor authentication, or 2FA, uses two different types of evidence. Multi-factor authentication, or MFA, uses two or more. These can include something you know, such as a password; something you hold, such as a registered device or security key; and something you are, such as a fingerprint used to unlock that device.
A password and a security answer both rely on knowledge. Adding more questions does not create a separate authentication factor.
Choosing an authentication method
Authenticator apps, one-time codes and hardware keys offer different levels of protection and convenience. The method must work with the application, the device and your staff’s working arrangements.
Where supported, consider phishing-resistant methods such as passkeys and FIDO2 security keys. Passkeys are designed to resist fake sign-in websites. The NCSC recommends passkeys over passwords wherever they are available.
Some applications support only text-message codes. Record these limitations and agree how to reduce the risk, particularly for administrator accounts and access to sensitive information.
Account recovery needs the same attention
A lost phone should have a clear recovery process. Agree how staff prove their identity, who can reset an authentication method and how the change is recorded.
Check backup methods and emergency access before a rollout. Protect any recovery codes, restrict who can use emergency accounts and review their use. A recovery process that accepts an unverified request can undermine the sign-in controls.
A practical rollout for your business
- List the applications staff and suppliers use, including email, remote access and administrator portals.
- Check which authentication methods each service supports and which accounts are already protected.
- Agree the required method and test it with a small group before a wider rollout.
- Show staff what a legitimate prompt looks like and how to report an unexpected request.
- Test account recovery and review any exceptions, shared accounts and supplier access.
- Verify that the intended policies apply, rather than relying on a record that someone registered an authentication app.
For Microsoft 365, the available controls depend on your licences and configuration. Microsoft explains the options in its multifactor authentication guidance.
Keep checking after the rollout
MFA reduces risk, but it does not make an account immune to compromise. Staff still need supported devices, appropriate access and a way to report suspicious activity. Review protection when people change roles, suppliers change or new applications are introduced.
Read our business data security strategy guide for the wider controls, or speak to CIS about account protection within your Microsoft 365 support arrangements.
