Two-Factor Authentication (2FA)
Two-factor authentication (2FA) is sign-in that requires two distinct types of authentication factor, typically a password (something you know) plus a phone, code generator or security key (something you have), which makes it the most common form of multi-factor authentication. NIST SP 800-63-4 defines MFA as "an authentication system that requires more than one distinct type of authentication factor" and notes that a password plus a PIN is not two factors, because both are something you know.
The label says nothing about which second factor is in use, and that is where 2FA succeeds or fails. An SMS code, an authenticator-app code and a push approval all count as 2FA, and all can be handed to an attacker by a person who believes the request is genuine: in August 2026 the AnonyMousKIT kit used a rented AI voice agent to phone theft victims and ask for their 2FA code. A passkey or FIDO2 security key is also a second factor but cannot be read aloud or typed into a fake page, which is why policies should name the method class (phishing-resistant MFA) rather than just require "2FA".
See also: MFA, one-time password, phishing-resistant MFA, AAL, MFA implementation best practices
Related on Start with Identity
- GlossaryMFA Fatigue
MFA fatigue, also called push bombing, is an attack in which someone who already has a user's password triggers push approval prompts over and over until the us
- GlossaryRisk-Based Authentication
Risk-based authentication (RBA) adjusts authentication requirements based on signals such as device, location, network, and behavior. Low-risk sessions pass smo
- GlossaryStep-up Authentication
Requiring additional authentication when a user attempts a higher-risk action, such as changing email or initiating a large payment. Implemented via OIDC `acr_v
- BlogEntra ID stops delivering SMS and voice codes on February 1, and global admins go last
From February 1, 2027, Microsoft stops providing SMS and voice authentication in Entra ID, and users with no other method must register a passkey to keep signin
- CVEOkta Verify for Windows local privilege escalation
Okta Verify on Windows could be turned into a local privilege escalation. The MFA app on the endpoint is part of the identity plane. Pair with Okta's 2024 FastP
- BlogThe SMS off-ramp has a date now: what Entra, GOV.UK and America.gov mean for your MFA plan
Microsoft stops delivering SMS and voice codes in Entra ID on February 1, 2027. The UK has opened passkeys to more than 23 million GOV.UK One Login users, and t