What is Multi Factor Authentication: Detailed Explanation

In short

Overview

The reasoning behind it is plain. Passwords get guessed, reused across sites, phished through a convincing email, or bought in bulk from a criminal marketplace. Add a second factor and a stolen password on its own gets an attacker nowhere.

For Irish businesses this has shifted from good practice to baseline expectation. NIS2 names it directly, DORA requires strong authentication from financial entities, and Microsoft already enforces it on its own admin portals. The question most leadership teams now face is not whether to turn it on, but which method to use and where the gaps still sit.

The basics

What Is Multi Factor Authentication and What Counts as a Factor?

Multi factor authentication combines proofs from two or more different categories, so compromising one gives an attacker nothing on its own. Two passwords are not MFA. Two security questions are not MFA either.

The factors have to come from genuinely separate categories, and that distinction is where a lot of well-meaning setups fall down.

A password plus a code from an authenticator app pulls from the first two categories, so it qualifies. A password plus a memorable word does not, because both live in the same place and both can be phished in the same conversation.

Business platforms add a layer on top of that. Conditional access policies decide when to prompt, using signals like device compliance, location or an unusual sign-in pattern. A managed laptop in the office might sail through, while the same account from a new device abroad gets challenged every time.

The terms

How Does MFA Differ From 2FA and Passwordless Sign-In?

Two factor authentication is MFA with exactly two factors, so every 2FA setup is MFA, but not every MFA setup stops at two. Vendors use the terms interchangeably, and in a business context the difference rarely changes what you configure.

Passwordless is a different idea. It removes the password rather than adding to it, replacing it with a passkey, biometric or hardware key, so the thing most often stolen no longer exists on the account. A passkey on a device the user unlocks with a fingerprint already satisfies two categories by itself, which is why it tends to be both stronger and faster than a password plus a texted code.

Strength and trade-offs

Which MFA Methods Are Strongest and Which Are Weakest?

Phishing-resistant methods such as passkeys and FIDO2 security keys are the strongest, because the credential is cryptographically tied to the real website and simply will not work on a fake one. Everything else trades some protection for convenience.

The NCSC's guidance on choosing authentication methods ranks them along similar lines, and the practical trade-offs matter more than the labels.

Any MFA beats none. The NCSC's own guide to multi-factor authentication makes that point for Irish organisations, rating app-based methods above texted codes while still treating a weak second factor as better than a lone password. If a supplier offers nothing stronger, switch it on and plan the upgrade.

The attack routes

How Do Attackers Get Past MFA?

Attackers rarely break the cryptography. They work around it, usually by stealing the session after a legitimate user has passed the check, or by convincing that user to approve something themselves. These are the routes that show up most often.

• Adversary-in-the-middle phishing. A fake login page relays everything to the real site in real time, then captures the session cookie once MFA is passed. The attacker replays the cookie and never faces a prompt.
• MFA fatigue. Repeated push notifications at eleven at night until someone taps approve to make it stop.
• SIM swap and number porting. The attacker takes control of the mobile number receiving the codes.
• Legacy protocols. Older mail connections and app passwords that skip modern sign-in entirely and leave a side door open.
• Help desk social engineering. A caller claiming a lost phone, talked through a factor reset by a helpful colleague.
• Infostealer malware. Session tokens lifted straight off an unmanaged or personal device.

Most of these target the mailbox first, because an inbox is where password resets, invoices and supplier conversations live. Pairing MFA with email security controls closes the common follow-on step, which is the quiet mailbox rule that forwards everything to an external address.

Rules and mandates

Where Is MFA Required Under Irish and EU Rules?

MFA is now written into EU security law rather than merely recommended. NIS2 lists multi-factor authentication among the baseline risk-management measures that essential and important entities must apply, and DORA requires strong authentication from financial entities, with its technical standard extending MFA to privileged and remote access.

The picture for an Irish business depends on which regimes it sits under.

• NIS2. Named as a baseline measure. Ireland has not yet transposed the directive, and the National Cyber Security Bill 2024 remains the vehicle for doing so.
• DORA. In force for financial entities, covering strong authentication on systems supporting critical or important functions.
• PCI DSS. Version 4.0 requires MFA for all access into the cardholder data environment.
• GDPR. Article 32 does not name MFA, but it requires security appropriate to the risk, and mailbox takeover is a common route to a reportable personal data breach.

Platform vendors have moved ahead of the legislation in places. Microsoft's mandatory MFA enforcement already covers sign-in to the Azure portal, the Entra and Intune admin centres and the Microsoft 365 admin centre, with later phases reaching command-line and scripting tools.

Insurers ask about it at renewal as well, usually about email and remote access specifically. For regulated firms, we handle this as part of ongoing compliance and governance work rather than a one-off switch, because supervisors want evidence of coverage, not an assurance that it was enabled once.

Practical steps

How Should a Business Roll Out MFA Without Locking People Out?

Start with the accounts that cause the most damage when they fall, then widen coverage in stages. Administrators, finance staff and anyone with remote access come first, because those are the accounts attackers look for.

A rollout that holds up tends to follow this order.

• Inventory the accounts. Include service accounts, shared mailboxes, contractors and anything still using an app password.
• Pick the method per group. Hardware keys or passkeys for admins and finance, authenticator apps with number matching for everyone else.
• Close the side doors. Disable legacy authentication protocols, or the new policy guards only the front entrance.
• Set conditional access rules. Decide which signals trigger a prompt and which trusted conditions do not.
• Register backup factors. A second key or an alternate device stops the lost-phone call becoming a lost day.
• Brief the help desk. Agree a written identity check before anyone resets a factor over the phone.

Shared logins are the usual sticking point, particularly a reception mailbox or an accounts inbox used by three people. Convert them to a shared mailbox with individual sign-ins rather than registering one phone against a password everybody knows.