Real Bytes
All Guides
Identity Security

Multi-Factor Authentication: The Complete Guide

Passwords alone are over. MFA blocks more than 99 percent of automated credential attacks. This guide covers every type, which are phishing-resistant, how to roll it out, and the attacks you still need to defend against.

Last updated April 202610 min read

Why MFA Matters

Credential theft is the single most common entry point for a breach. Phishing, password reuse, credential stuffing, and data leaks give attackers ready-to-use logins every day. MFA is the one control that makes a stolen password almost useless on its own.

81%

of breaches involve stolen or weak passwords

99%+

of automated credential attacks blocked by MFA

$4.26M

average Australian breach cost (OAIC 2024)

How MFA Works

MFA requires two or more of these three factors:

Something you know

Password, PIN, passphrase

Weak alone. Can be guessed, phished, or leaked.

Something you have

Phone, hardware key, smart card

Physical possession. Hard to steal remotely.

Something you are

Fingerprint, Face ID, iris

Biometric. Strong but requires device support.

MFA Types: Weakest to Strongest

1

SMS / Text Code

Weak

A 6-digit code sent via SMS. Vulnerable to SIM swap, SS7 interception, and real-time phishing.

ACSC: Not recommended for business use.

2

Email Code

Weak

Code sent to a secondary email. Only as secure as that inbox. If mail is compromised, MFA falls with it.

ACSC: Avoid for any privileged account.

3

Authenticator App (TOTP)

Good

Time-based codes from Microsoft Authenticator, Google Authenticator, or Authy. No SIM dependency. Still vulnerable to adversary-in-the-middle phishing.

ACSC: Minimum acceptable for standard accounts.

4

Push with Number Matching

Good

Push notification that requires typing a number shown on the login screen. Blocks simple MFA fatigue attacks.

ACSC: Enable number matching everywhere.

5

FIDO2 / Passkeys / Hardware Keys

Strongest

Cryptographically bound to the domain. Phishing is technically impossible. Works with YubiKey, Windows Hello for Business, Face ID, and synced passkeys.

ACSC: Required for privileged accounts at Maturity Level 3.

Phishing-Resistant MFA (The Only Kind That Really Works)

Attackers have caught up. Adversary-in-the-middle toolkits like Evilginx proxy the real login page, capture credentials, capture MFA codes, and steal the session cookie in real time. Codes and push prompts do not stop this. Only cryptographically bound MFA does.

FIDO2 Hardware Keys

YubiKey, Feitian, Token2. USB-A, USB-C, NFC, or lightning. Tie them to a user in Entra ID. Pair with a backup key kept in a safe.

Passkeys / Platform Authenticators

Windows Hello for Business, Face ID on iPhone, Android platform authenticator. Synced passkeys work across devices. Phishing-resistant by design.

Implementation Plan

1

Start with Microsoft 365 / identity platform

Enable MFA in Entra ID via Conditional Access. Protects email, Teams, SharePoint, and every federated SaaS app in one place.

2

Cover every cloud service

Xero, HubSpot, Salesforce, AWS, Google Admin, GitHub, your password manager, your RMM. If it has a login, it gets MFA.

3

Enforce MFA on remote access

VPN, RDP, remote desktop gateways, and Bastion. This is an Essential Eight requirement and cyber insurance baseline.

4

Protect privileged accounts with FIDO2

Global admins, domain admins, executives, and finance should use hardware keys or Windows Hello for Business. Phishing-resistant only.

5

Enable number matching and context

Microsoft Authenticator shows the app, location, and a number to match. Blocks prompt bombing.

6

Train staff on safe behaviour

Never approve a prompt you did not start. Report suspicious prompts. Never read codes aloud on the phone.

7

Review break-glass accounts

Keep two emergency accounts excluded from MFA policies, stored in a physical safe. Review access quarterly.

MFA Bypass Attacks to Know

MFA Fatigue / Prompt Bombing

Attacker spams push prompts until the user taps Approve. Fix: enable number matching.

Adversary-in-the-Middle (AiTM)

Proxy captures credentials, codes, and session cookies in real time. Fix: FIDO2 keys or passkeys.

SIM Swap

Attacker ports the phone number and intercepts SMS. Fix: never use SMS MFA.

Session / Token Theft

Malware on the endpoint steals refresh tokens. Fix: Conditional Access, token protection, compliant devices only.

Help Desk Social Engineering

Attacker calls IT and resets MFA. Fix: identity verification scripts, caller-ID proofing, ticket required.

Downgrade Attacks

User is forced back to a weaker method. Fix: block legacy authentication, enforce phishing-resistant methods for admins.

Common Mistakes

SMS MFA on admin accounts

SIM swap gives an attacker full admin access. Use hardware keys.

No break-glass accounts

If MFA breaks for your tenant, you get locked out. Keep two break-glass accounts excluded and stored safely.

Legacy authentication still enabled

Basic auth bypasses MFA entirely. Block it in Conditional Access.

Mixing personal and work MFA on one phone

Lose the phone, lose both. Separate work authenticator or hardware keys for privileged users.

No session controls

MFA protects the login. Conditional Access sign-in frequency and token protection protect the session.

Related: Passwordless Authentication, Microsoft 365 Security Baseline, Essential Eight.

Roll Out MFA Properly

We deploy phishing-resistant MFA across Microsoft 365, Google Workspace, VPN, and SaaS apps, including Conditional Access and hardware keys for privileged accounts.

Managed Cybersecurity Book an MFA Audit