Multi-factor authentication

MFA is something you know plus something you have. The have is not all equal: a hardware key or a passkey that will not sign for the wrong origin is phishing-resistant. SMS and email codes can be redirected or relayed. They are still better than a password alone. Do privileged accounts, remote access, and email first.

First principles

Authentication asks a person (or a workload) to prove an identity. Something you are — a biometric — usually unlocks the have, rather than standing alone against a remote service. A one-time code typed into a page you did not mean to visit can be relayed. Prefer the resistant form where the account is worth it.

Where to start

Privileged accounts, remote access, and email. Those three first. An admin portal with a password only is a standing invitation. A VPN or a desktop that lands on the internal network with a password only is the same invitation with a bigger blast radius. Email is how password resets and OAuth grants travel; protect it or the rest unravels.

What an admin actually does

• Turn MFA on for identity providers, email, VPN, cloud consoles, and any admin path, before you argue about staff SaaS.
• Issue hardware keys or platform passkeys to admins. Keep a spare key in a sealed break-glass process.
• SMS is acceptable as a floor, not as the design for privileged users.
• MFA on a shared account is theatre. Shared accounts cannot be enrolled honestly. Give people their own identities.
• Record recovery codes in the password manager, not in the same inbox you just protected.