Multi-Factor Authentication (MFA)

Definition

Multi-factor authentication requires a second proof of identity beyond a password – something the user has (a hardware key, an authenticator app, a phone) or something they are (a fingerprint or face) – before access is granted. Methods are not equal: SMS codes and push notifications can be intercepted or fatigued into approval, while FIDO2 hardware keys and passkeys resist phishing because the credential is bound to the legitimate site and never leaves the device.

Why it matters to an MSP

Stolen credentials are the entry point in most SMB breaches, and password-only Microsoft 365 accounts are the raw material for BEC fraud and ransomware footholds. That is why MFA is the first line on every cyber insurance questionnaire: carriers decline to write or renew without MFA on email, remote access, and admin accounts, and a "yes" that turns out to be false can void a claim. It also sits in CIS Controls safeguards 6.3–6.5 and every compliance framework you sell against, so an MFA rollout is a well-defined, billable project.

Two rules. First, coverage has to be complete: one legacy protocol left open, one service account excluded, one shared mailbox on basic auth is the account attackers find. Pair enrollment with conditional access that blocks legacy authentication and enforces MFA on every sign-in, not just "risky" ones. Second, raise the method with the privilege. Push and SMS are still acceptable for a general user, but push-fatigue and adversary-in-the-middle phishing kits bypass them routinely; admin accounts, your own technicians, and access to your RMM and PSA should use FIDO2 keys or passkeys. Your MSP is the highest-value target in your client base, so start there – and treat MFA coverage as a standing QBR artifact.

Related terms: SSO, IAM, PAM, Zero Trust