Multi-Factor Authentication (MFA): Types and Rollout Steps

Multi-Factor Authentication (MFA): Types and Rollout Steps

Multi-factor authentication (MFA) is a login control that asks a user for two or more proofs of identity from different categories, such as a password plus a security key, before granting access. It matters because a stolen password alone is no longer enough to get in. For most organizations, the right goal is phishing-resistant MFA (FIDO2 security keys, passkeys or smart cards) for everyone, starting with administrators and email.

This article is general information, not legal advice.

Key takeaways

  • MFA combines at least two different factor types: something you know, something you have and something you are.
  • Not all MFA is equal. CISA ranks SMS and voice codes as a last resort and FIDO/WebAuthn as the strongest widely available option.
  • NIST SP 800-63B requires a phishing-resistant authenticator at its highest assurance level (AAL3) and says verifiers must offer one at AAL2.
  • MFA fatigue (push bombing) attacks target simple "approve or deny" prompts. Number matching is the interim fix; phishing-resistant MFA is the lasting one.
  • Roll MFA out in phases: high-value systems and privileged users first, then everyone, then retire weak methods.

What is multi-factor authentication and how does it work?

MFA works by requiring evidence from more than one category, so an attacker who steals one piece (usually the password) still cannot log in. NIST describes it as a way to "present two pieces of evidence" when you sign in, and stresses that the two must come from different categories.

The NIST overview of multi-factor authentication groups credentials into three factor types:

Factor typePlain meaningExamples
KnowledgeSomething you knowPassword, PIN, passphrase
PossessionSomething you havePhone with an authenticator app, hardware security key, smart card
InherenceSomething you areFingerprint, face scan

Two passwords do not count as MFA, because both are knowledge factors. A password plus a code from your phone does count, because the phone is a possession factor. In modern deployments, biometrics usually open a device or key locally rather than being sent to a server. If you want the detail on that, see our explainer on whether biometrics are better than passwords.

MFA sits inside your broader identity and access management (IAM) program, which decides who gets access to what. MFA answers a narrower question: is this really the person who owns the account?

Which MFA methods are strongest?

Phishing-resistant methods (FIDO2 security keys, passkeys and PKI smart cards) are the strongest, and SMS or voice codes are the weakest. Everything in between can still be stolen by a convincing fake login page.

The key term here is phishing-resistant: an authenticator that cryptographically binds the login to the real website, so a look-alike site cannot capture and replay it. FIDO2 is the open standard (built on the WebAuthn browser standard) that makes this work. A passkey is a FIDO credential stored on a phone, laptop or password manager instead of a separate USB or NFC key.

The ranking below follows CISA's fact sheet on implementing phishing-resistant MFA, from strongest to weakest:

RankMethodPhishing-resistant?Main weakness
1FIDO2 security keys and passkeys (WebAuthn)YesNeeds enrollment planning and backup keys
1PKI smart cards (certificate based)YesRequires mature identity and certificate management
2Push with number matchingNoA user can still type a code into a phishing page flow
2Authenticator app or hardware token one-time passcode (OTP)NoCodes can be relayed through a fake login page
3Push without number matchingNoVulnerable to MFA fatigue attacks
4SMS or voice codesNoSIM swaps, number porting and interception; CISA calls it a last resort

CISA states plainly that "any MFA is better than no MFA" on its MFA guidance page. So if SMS is all a system supports today, turn it on, and then plan your move up the table.

What do NIST authenticator assurance levels require?

NIST SP 800-63B defines three authenticator assurance levels (AALs), and the higher the level, the stronger the proof of identity required. AAL3 requires a phishing-resistant authenticator, and AAL2 requires that one be offered.

An authenticator assurance level is NIST's measure of how confident you can be that the person logging in controls the account. Here is a summary of the current NIST SP 800-63B Digital Identity Guidelines:

LevelFactorsPhishing resistanceReauthentication (overall)
AAL1Single factor allowed; MFA should be offeredNot requiredShould be no more than 30 days
AAL2Two distinct factors or a multi-factor authenticatorVerifiers shall offer at least one phishing-resistant optionShould be no more than 24 hours
AAL3Cryptographic authenticator with a non-exportable private keyRequiredShall be no more than 12 hours

A few details in the NIST text are worth knowing before you choose methods:

  • Using the phone network (SMS or voice) for codes is a restricted authenticator, and verifiers must make alternatives available.
  • Email "shall not" be used for out-of-band authentication.
  • Syncable authenticators (passkeys that copy across devices) cannot be used at AAL3, because their keys are exportable.
  • Simple approve-only push prompts are "no longer considered acceptable," and push verifiers should limit how many prompts they send.

For most workforce systems, AAL2 with a phishing-resistant method is a sensible baseline. Reserve AAL3 hardware keys for administrators, finance approvers and anyone who can change identity settings.

What does CISA recommend for phishing-resistant MFA?

CISA recommends that organizations move to phishing-resistant MFA, and calls FIDO/WebAuthn "the only widely available phishing-resistant authentication." Where that is not yet possible, CISA says to use number matching as an interim step.

US federal policy points the same way. OMB Memorandum M-22-09 states that "for agency staff, contractors, and partners, phishing-resistant MFA is required," and that public-facing systems must give users a phishing-resistant option. Private companies are not bound by that memo, but it is a clear signal of where the standard of care is heading.

Phishing-resistant MFA also fits naturally into a zero trust architecture, where every access request is verified rather than trusted because it comes from inside the network.

What is an MFA fatigue attack and how do you stop it?

An MFA fatigue attack (also called push bombing) is when an attacker who already has a password floods the user with login prompts until the user approves one. Number matching and phishing-resistant MFA are the two main defenses.

CISA's fact sheet on number matching explains that users may approve a prompt by accident, to stop the noise, or because they believe it is real. Number matching fixes this by showing a number on the login screen that the user must type into the app. Someone who is not looking at that screen cannot approve the request.

To reduce the risk further:

  • Turn on number matching for every push-based method you still allow.
  • Limit the number of push prompts per account, as NIST suggests.
  • Train staff to deny and report unexpected prompts.
  • Treat a denied push as a sign that the password may be compromised, and investigate. Your incident response plan should cover this trigger.

How do you roll out MFA across an organization?

Roll MFA out in phases: protect your most valuable systems and most privileged people first, then extend to all users, then remove weak methods. CISA's phishing-resistant MFA guidance recommends exactly this phased approach, starting with groups such as help desk and IT administrators.

  1. Inventory systems and accounts. List every application, remote access path and identity provider, and note which ones support FIDO2, push or only SMS. Include service accounts and shared accounts.
  2. Rank what to protect first. CISA points to email, file servers, remote access and identity servers. Add HR and payroll systems; see our guide on protecting confidential HR files.
  3. Set your target level. Decide which systems need AAL2 and which need AAL3, and write a policy stating which methods are allowed for each.
  4. Centralize sign-in. Route applications through single sign-on so you enforce MFA in one place rather than app by app.
  5. Pilot with IT and administrators. Issue security keys or passkeys to admins and help desk staff first. They face the most attacks and will surface practical problems.
  6. Design recovery before go-live. Issue a backup key per person for hardware keys, and define how the help desk verifies identity before resetting MFA. Attackers often target the reset process, not the login.
  7. Expand in waves. Move by department or region, with clear communications, short how-to guides and extra help desk staffing in the first week of each wave.
  8. Handle exceptions deliberately. For staff without smartphones or in shared-device roles, provide hardware keys or smart cards rather than falling back to SMS.
  9. Retire weak methods. Once coverage is high, turn on number matching everywhere, then disable SMS and approve-only push for workforce accounts.
  10. Monitor and review. Track enrollment rates, denied prompts and MFA resets, and review the policy at least once a year.

Cloud services deserve early attention because they are reachable from anywhere. Our list of cloud security techniques for HR and IT leaders covers related controls.

Common mistakes when deploying MFA

Most failed MFA programs fail on exceptions and recovery, not on the login itself. Watch for these:

  • Stopping at SMS. It is better than nothing, but it leaves you open to SIM swaps and phishing.
  • Leaving legacy protocols open. Older mail and directory protocols that cannot prompt for MFA give attackers a side door.
  • Weak help desk resets. If a caller can get MFA reset by knowing an employee ID, your MFA is only as strong as that phone call.
  • Exempting executives or admins. These are the accounts attackers want most.
  • Ignoring vendors and contractors. Third-party accounts with access to your systems need the same rules.
  • Not watching denied prompts. A denial often means someone already has the password.

If you carry cyber insurance, check what your policy says about MFA coverage before a claim, not after. Our overview of cyber insurance for small businesses explains what to review.

FAQ

Is two-factor authentication the same as MFA?

Two-factor authentication (2FA) is a type of MFA that uses exactly two factors. MFA is the broader term for two or more factors from different categories. NIST treats the terms as closely related.

Are passkeys phishing-resistant?

Yes. Passkeys use the FIDO/WebAuthn standard, which binds the credential to the real website, so a fake site cannot capture it. Under NIST SP 800-63B, synced passkeys cannot be used at AAL3, so use device-bound hardware keys for your highest-risk accounts.

Should we stop using SMS codes?

Plan to. NIST lists phone network codes as restricted and CISA calls them a last resort. Keep SMS only where nothing stronger is available, and set a date to replace it for workforce accounts.

How long does an MFA rollout take?

It depends on how many systems you have and whether they support single sign-on and FIDO2. A pilot with administrators can happen in weeks; a full move to phishing-resistant MFA often runs in several phases over a longer period.

What to do next

Start this week by listing your privileged accounts and checking which MFA methods each one uses. Issue phishing-resistant keys or passkeys to administrators and help desk staff first, turn on number matching for any push method you still allow, and write down your help desk reset procedure. Then build the phased plan above into your next quarter's security roadmap and report enrollment progress to leadership each month.

Sources

Last reviewed: November 2026.

Comments

Post a Comment

Popular Posts

Why Workday Onboarding Breaks Down for Frontline Employees

Image
Workday onboarding breaks down for frontline employees because its default setup assumes every new hire has an email address, a personal device, time at a desk and comfort with a web portal. Warehouse, retail, food service and healthcare aide roles often have none of those. The fix is mostly configuration and process, not a new system. This guide is for HR, HRIS and operations leaders who run Workday and keep seeing incomplete onboarding records, late I-9s and new hires who quit before their first paycheck. Key takeaways Default Workday onboarding is built around desk workers. Frontline failures are predictable and mostly fixable through configuration. The five usual breakpoints are email-based logins, no reliable device, digital comfort, shift timing and language. Split compliance-critical tasks (I-9, tax forms, direct deposit) from tasks that can wait, and handle I-9 in person. Kiosks, ID-based logins, text reminders and a supervisor checklist close most of the gap. Measure...
Read more

Interview Tips for Beginners: A Step-by-Step Prep Plan

Image
The best interview tips for beginners come down to preparation you can repeat: study the job description, research the employer, prepare four to six short stories that prove your skills, practice answering out loud, prepare your own questions and follow up within a day. Confidence comes from rehearsal, not from experience you don't have yet. This plan is for students, recent graduates and career changers facing their first few interviews, and for anyone who freezes when asked "tell me about yourself." Key takeaways Match your preparation to the job description, line by line. Use the STAR format (situation, task, action, result) for behavioral questions. School, volunteer and part-time examples count when you have little work history. Practice aloud at least twice; silent rehearsal isn't enough. Prepare two or three thoughtful questions for the interviewer. What does a one-week interview prep plan look like? If you have an interview scheduled, this plan s...
Read more

How to Improve the Customer Experience (CX)

Image
To improve customer experience, find the moments where customers struggle most, fix those first, and make good service consistent across every channel. Then close the loop on feedback, give front-line staff the time and tools to solve problems, and track a small set of metrics someone actually owns. This guide is for leaders and managers who own some part of the customer relationship, whether that's support, sales, operations or the product itself. Customer experience is the sum of every interaction someone has with your company, from the first ad they see to how a return is handled years later. Teams that struggle usually confuse a good satisfaction score with real improvement, or fix the wrong things. Key takeaways Look at behavior (drop-offs, ticket spikes, failed searches), not just surveys. Fix the biggest sources of friction before polishing what already works. Collecting feedback and doing nothing with it makes customers more frustrated. Consistency across people a...
Read more

How to Market Your Handyman Services to Small Business Owners

Image
To market handyman services to small business owners, position yourself as the reliable, flexible vendor who can handle many small jobs with little disruption. Make your Google Business Profile and website clearly commercial, pick two or three business types to target, visit them in person, offer a simple service account, and ask every client for reviews and referrals. This is for independent handymen and small maintenance crews who rely on word of mouth and want a steadier flow of repeat commercial work. Referrals are great until they dry up for a month. Small businesses are a strong target because they have constant maintenance needs, little in-house help, and a clear preference for vendors they can call again and again. Key takeaways Business owners buy speed, reliability and minimal disruption, not just repairs. Say that in your marketing. Your Google Business Profile should clearly describe commercial work and the business types you serve. Focus on a few business types (r...
Read more

Are Biometrics Better Than Passwords? What NIST Says

Image
Biometrics beat passwords in some ways and lose in others. You can't forget a fingerprint, reuse it across sites or type it into a phishing page, so logins get faster and harder to steal. But you can't change a face if its data leaks, which is why NIST says a biometric should never be used alone, only alongside a physical device. This guide is for IT, security and HR leaders deciding how far to move their workforce away from passwords. Key takeaways Biometrics fix common password problems: reuse, weak choices and forgotten credentials. NIST SP 800-63B says a biometric "is not recognized as an authenticator by itself." The strongest pattern is a biometric that activates a key stored on a device, as with passkeys and security keys. Workplace biometrics bring notice, consent and retention duties under some state laws. Always offer a non-biometric alternative. Why do passwords keep failing? Passwords depend on people choosing, remembering and guarding secret...
Read more

Are Mobile Apps Tracking Your Every Move? How to Check

Image
Mobile apps can track your location and activity, but only as far as the permissions on your phone allow. Open your privacy settings, find apps with "always" location access, switch most to "while using" or off, limit your advertising identifier and delete apps that ask for more than they need. Ten minutes covers most of it. This is for anyone who has noticed ads that seem to know where they've been, or who simply hasn't looked at app permissions since setting up the phone. Key takeaways Location, contacts, photos, microphone and camera access are all controlled by per-app permissions. Background ("always") location access is the setting most worth reviewing. Advertising identifiers let companies link your activity across apps; you can limit or reset them. Turning off location doesn't stop account-based tracking inside apps you sign in to. Work phones can carry extra monitoring set by your employer, governed by company policy. How ...
Read more

Predictive Scheduling Laws: Where They Apply and How to Comply

Image
Predictive scheduling laws require covered employers to give hourly workers their schedules in advance, usually 14 days, and to pay a premium when the employer changes a shift after posting. Oregon has a statewide law, and cities including Seattle, New York City, Chicago, Los Angeles, San Francisco and Philadelphia have their own ordinances. This guide is for HR, operations and payroll leaders who schedule hourly staff in retail, restaurants, hospitality and similar industries across more than one location. This article is general information, not legal advice. Key takeaways The federal Fair Labor Standards Act has no rules on scheduling adult employees, so predictive scheduling (also called fair workweek or secure scheduling) duties come from state and city law. Oregon, Seattle, Los Angeles, Philadelphia and New York City fast food all require schedules at least 14 days in advance for covered workers. Coverage usually depends on industry plus a size threshold, such as 500 emp...
Read more

Dollar General Store Walkout: Lessons for Retail HR

Image
In March 2024, every employee at a Dollar General store in Mineral Point, Wisconsin, quit at once and taped "We quit" signs to the doors. They cited a lack of appreciation, being overworked and being underpaid, plus a dispute over a rule about which unsold items could be donated. The store reopened about three hours later. The story went viral because it was so visible, but the lesson is quieter. For HR and operations leaders who run hourly, small-team locations, this is a case study in how a minor policy can become the last straw. Key takeaways A policy change triggered the walkout, but the notes employees left pointed first to workload, pay and recognition. Rules that clash with frontline values, such as throwing away usable goods, become flashpoints when trust is already low. Explaining why a rule exists, and giving local teams a way to push back, costs far less than losing a whole store team. Treat a mass resignation as a lagging indicator. The warning signs show...
Read more

Boss Retaliation and False Accusations: Protect Yourself

Image
To protect yourself from boss retaliation and false accusations, keep a dated written record, answer accusations with facts rather than anger, use your employer's complaint channels, and learn which laws cover you. Retaliation for protected activity, like reporting discrimination or a safety hazard, is illegal under federal law, and agency filing deadlines can be very short. This guide is for employees who sense that something changed after they spoke up, and for anyone suddenly facing an accusation they know is untrue. Key takeaways Retaliation is illegal when it follows protected activity, such as reporting discrimination or safety concerns. A dated, factual record is your strongest protection. Respond to false accusations in writing, with evidence, and without counterattacking. Use internal channels first when it's safe, but know the external deadlines. An employment attorney can advise on your specific situation. This article is general information, not legal a...
Read more

How Do I Log In and Sign In to Workday HCM

Image
To log in to Workday HCM, open your organization's own Workday URL (there's no single public login page), then sign in either with your Workday username and password or through your company's single sign-on. If you're locked out, use "Forgot password" for native logins, or your corporate password reset for SSO, and contact HR or IT if neither works. This guide is for employees and managers signing in for the first time, people who've just switched employers, and anyone stuck at the login screen. Most Workday access problems come down to the wrong URL, the wrong login method, or an account that needs an admin to reset it. Key takeaways Each employer has its own Workday tenant and URL. Get it from HR, IT or your onboarding email; don't guess. If your company uses SSO, your Workday password is your normal work password, and resets happen through your company, not Workday. The mobile app asks for your organization's details first, then signs y...
Read more