Multi-Factor Authentication (MFA) Best Practices - Complete 2024 Guide

Security Best Practices

MFA Best Practices

READING TIME

20 minutes

DIFFICULTY

Beginner to Advanced

DEFINITION

Multi-Factor Authentication (MFA) requires users to verify their identity using two or more independent factors: something they know, something they have, or something they are.

The Bank Vault Analogy: Passwords are like knowing the vault’s combination—anyone who learns it can get in. MFA adds a key card that must also be swiped. Even if someone steals the combination (password phishing), they can’t open the vault without the physical card (your second factor).

Why MFA is Non-Negotiable

The data is overwhelming:

Statistic	Source
99.9% of account compromise attacks are blocked by MFA	Microsoft
80% of breaches involve compromised credentials	Verizon DBIR 2024
$4.88M average cost of a data breach in 2024	IBM
74% of breaches involve human element (phishing, etc.)	Verizon

MFA is the single most effective security control you can implement. Period.

The Three Authentication Factors

🧠

Something You Know

---

Knowledge factors: Passwords, PINs, security questions. Easy to deploy but weakest against phishing.

📱

Something You Have

---

Possession factors: Phone, security key, smart card. Requires physical theft to compromise.

👆

Something You Are

---

Inherence factors: Fingerprint, face, iris. Unique to individual, difficult to replicate.

True MFA requires factors from at least two different categories:

✅ Valid MFA	❌ Not True MFA
Password + SMS code	Password + security question (both “know”)
Password + authenticator app	Two different passwords
Fingerprint + security key	Face ID + fingerprint (both “are”)
Password + push notification	Email code where email uses same password

MFA Methods Ranked by Security

🏆 Phishing-Resistant

Tier 1: Phishing-Resistant MFA (Recommended)

These methods cannot be phished because they’re cryptographically bound to the legitimate site:

Method	How It Works	Best For
FIDO2/Passkeys	Public-key cryptography, no shared secrets	All users, ideal replacement for passwords
Hardware Security Keys	Physical USB/NFC device (YubiKey, Titan)	High-value targets, admins, executives
Platform Authenticators	Face ID, Windows Hello, Android biometrics	Consumer apps, workforce BYOD
Certificate-Based	Smart cards, PIV credentials	Government, highly regulated industries

Why they’re phishing-resistant:

• Cryptographic challenge is bound to the origin
• Fake sites can’t complete the handshake
• No secrets transmitted that can be intercepted

Passkeys Implementation Guide →

🥈 Strong (Phishable)

Tier 2: Strong MFA (Good, but can be phished)

These methods are significantly better than passwords alone, but sophisticated attackers can bypass them with real-time phishing:

Method	How It Works	Vulnerability
Authenticator Apps (TOTP)	Time-based codes (Google/Microsoft Authenticator)	Attacker proxies code in real-time
Push Notifications	Approve/deny on phone (Okta Verify, Duo)	MFA fatigue, accidental approval
Number Matching	Enter number shown on screen	Reduces fatigue, still phishable

Mitigation: Combine with conditional access (device trust, location) to make phishing harder.

MFA Strategies Guide →

🥉 Weak / Legacy

Tier 3: Weak MFA (Avoid for sensitive access)

These methods have known vulnerabilities and should only be used when better options aren’t available:

Method	How It Works	Critical Vulnerability
SMS OTP	Code sent via text message	SIM swapping, SS7 vulnerabilities
Voice Call	Code delivered by phone call	Voicemail compromise, call forwarding
Email OTP	Code sent to email	Email often secured by weak password
Security Questions	Questions like “Mother’s maiden name”	Publicly discoverable, social engineering

If you must use SMS:

• Use as fallback only, not primary method
• Combine with device trust/conditional access
• Monitor for SIM swap attempts

Passwordless Migration Guide →

MFA Best Practices

1. Enforce MFA for Everyone, Prioritize Strategically

Rollout Priority:

1

Privileged Accounts (Immediate)

Global admins, security admins, break-glass accounts. Use phishing-resistant MFA only.

2

IT & Security Staff (Week 1)

Anyone with elevated access to systems. Hardware keys recommended.

3

Executives & Finance (Week 2)

High-value targets for spear phishing and BEC attacks.

4

All Employees (Month 1)

Full workforce rollout with training and support.

5

External Users (Month 2+)

Contractors, partners, B2B guest users.

2. Choose the Right Factor for the Context

Context	Recommended Factor	Why
Admin portals	Hardware security key	Highest security for highest risk
Office workers (managed devices)	Platform authenticator (Windows Hello)	Seamless, no separate device needed
Remote workers (BYOD)	Authenticator app + number matching	Works on personal devices
Frontline workers (shared devices)	Hardware key or push to personal device	No persistent login on shared device
Customer-facing apps	Passkeys or authenticator app	Balance security with experience
Legacy app fallback	SMS (with monitoring)	Better than nothing when required

3. Implement Phishing-Resistant MFA for Admins

This is non-negotiable. Every major breach in recent years could have been prevented:

Breach	How Attackers Got In	MFA Status
MGM Resorts (2023)	Vishing → IT help desk reset MFA	SMS-based MFA bypassed
Okta (2023)	Phished support engineer	Push notification approved
Twilio (2022)	SMS phishing to employees	SMS codes intercepted
Uber (2022)	MFA fatigue attack	Push spam until approval

The solution: Require FIDO2 security keys for all admin access. No exceptions.

4. Prevent MFA Fatigue Attacks

Attackers spam push notifications until exhausted users accidentally approve:

Mitigations:

Strategy	Implementation
Number matching	User types number shown on login screen
Geographic context	Show login location in push notification
Rate limiting	Lock account after X denied attempts
Anomaly detection	Alert on unusual MFA patterns
Trusted devices	Reduce prompts on known devices

5. Plan for MFA Recovery

What happens when users lose their second factor?

Scenario	Recovery Method
Lost phone (authenticator app)	Pre-registered backup codes
Broken security key	Backup key registered in advance
New phone	Self-service transfer via verified email
Forgotten everything	Identity proofing + help desk verification

Best Practice: Require users to register at least two MFA methods during enrollment.

6. Balance Security with User Experience

MFA shouldn’t punish legitimate users:

Strategy	How It Helps
Trusted devices	Remember MFA status on known devices for 30 days
Step-up authentication	Full MFA only for sensitive actions
Risk-based prompting	Only challenge on anomalous sign-ins
SSO integration	MFA once at IdP, access all apps
Passwordless	Replace password + MFA with single Passkey

Implementation Guide

Step 1: Assess Current State

Questions to answer:
- What percentage of users have MFA enabled today?
- Which MFA methods are currently in use?
- Are admins using stronger methods than regular users?
- What's the current MFA bypass/reset process?
- Which apps enforce MFA? Which don't?

Step 2: Define Target State

Example target state:
- 100% of users enrolled in MFA
- Admins: FIDO2 hardware keys required
- Employees: Authenticator app + backup codes minimum
- No SMS as primary factor
- MFA required for all cloud apps
- Risk-based MFA reduces friction for low-risk access

Step 3: Configure MFA Policies

Azure AD / Entra ID

Conditional Access for MFA:

Policy: Require MFA for All Users
├── Assignments
│   ├── Users: All users
│   ├── Cloud apps: All cloud apps
│   └── Conditions: Any location, any device
└── Access controls
    └── Grant: Require multifactor authentication

Stronger policy for admins:

Policy: Require Phishing-Resistant MFA for Admins
├── Assignments
│   ├── Users: Directory role = Global Admin, Security Admin
│   └── Cloud apps: All cloud apps
└── Access controls
    └── Grant: Require authentication strength = Phishing-resistant

Azure AD Conditional Access →

Okta

Global MFA Policy:

Security → Multifactor → Factor Enrollment
├── Okta Verify: Required
├── FIDO2 WebAuthn: Optional (Required for admins)
├── SMS: Optional (Not for admins)
└── Security Question: Disabled

Sign-On Policy:

Applications → [App] → Sign-On Policy
├── Rule 1: Admins
│   ├── Access: Allowed
│   └── MFA: FIDO2/WebAuthn required
└── Rule 2: Everyone else
    ├── Access: Allowed
    └── MFA: Any factor

Okta MFA Configuration →

Auth0

MFA with Guardian:

// Enable MFA for all users
Management API:
PATCH /api/v2/guardian/factors/sms
{ "enabled": true }

PATCH /api/v2/guardian/factors/push-notification
{ "enabled": true }

// Require MFA rule
Auth Pipeline Rules:
function requireMFA(user, context, callback) {
  context.multifactor = {
    provider: 'any',
    allowRememberBrowser: true
  };
  callback(null, user, context);
}

Auth0 MFA Guide →

Step 4: User Enrollment

Self-Service Enrollment Flow:

1. User attempts to access protected resource
2. System detects no MFA registered
3. Redirect to enrollment wizard
4. User registers primary method (authenticator app)
5. User registers backup method (backup codes or email)
6. Confirmation and test challenge
7. Access granted

Communication Template:

Subject: Action Required: Set Up Multi-Factor Authentication

Hi [Name],

To protect your account and our company data, we're requiring
multi-factor authentication (MFA) for all users.

What you need to do:
1. Download Microsoft Authenticator / Okta Verify on your phone
2. Visit [enrollment URL] to set up MFA
3. Complete enrollment by [deadline]

This will take about 5 minutes. If you need help, [contact IT].

Why this matters: MFA blocks 99.9% of account attacks, protecting
both you and the company from hackers.

Step 5: Monitor and Iterate

Key Metrics to Track:

Metric	Target	Red Flag
MFA coverage	100%	< 90% enrolled
Method distribution	80%+ strong methods	High SMS usage
MFA failure rate	< 5%	> 10% indicates UX issues
MFA bypass requests	Decreasing	Increasing means friction
Phishing simulation clicks	Decreasing	High-risk users need more MFA

Common MFA Mistakes

❌ Mistake 1: Allowing Exceptions

"Our executives don't like MFA interruptions"
→ Executives are highest-value targets for attackers
→ NO EXCEPTIONS for privileged users

❌ Mistake 2: SMS as Primary Factor

"SMS is easy, everyone has a phone"
→ SIM swapping is trivial for attackers
→ Use SMS only as absolute last resort

❌ Mistake 3: Not Enforcing MFA on Legacy Apps

"Legacy app doesn't support MFA"
→ Put it behind an application proxy with MFA
→ Or implement app passwords (and audit heavily)

❌ Mistake 4: No Backup Recovery Path

"User lost their phone and security key"
→ Without backup, identity verification is manual and slow
→ Always require backup method during enrollment

MFA Roadmap to Passwordless

MFA is the stepping stone to eliminating passwords entirely:

1

Today: Password + MFA

Password as primary factor, MFA as second factor. Standard 2FA.

2

Near-term: Password or Passwordless

Offer Passkeys alongside passwords. Users can choose.

3

Medium-term: Passwordless Preferred

Passkeys as default, passwords as fallback for edge cases.

4

Future: Passwords Eliminated

No passwords to phish, steal, or reset. True passwordless.

Passwordless Authentication Guide →

Next Steps

Passwordless Authentication

Eliminate passwords entirely with Passkeys and biometrics. Passwordless Guide →

Conditional Access

Add context-aware policies that reduce MFA friction. Conditional Access →

Risk-Based Authentication

Use risk signals to determine when to prompt for MFA. Risk-Based Auth →

SSO Implementation

Combine MFA with SSO for secure, seamless access. SSO Guide →

---

Strengthen Your Authentication

Explore our complete authentication pattern library with implementation guides for all major platforms.

Authentication PatternsGo Passwordless