Multifactor authentication
Multifactor authentication is an authentication method that verifies identity using evidence from at least two distinct authentication-factor categories.
ASP.NET Core in Action, 3e
Multifactor authentication is authentication that requires evidence from multiple independent credential or verification factors.
- How it is used
- Adds a second sign-in requirement when protecting accounts managed by an ASP.NET Core application.
- How deep it goes
- Defines MFA and points to Identity’s account-management setup, but defers QR-code customization and does not work through MFA implementation.
- Examples
- Uses SMS and mobile-app codes as sign-in examples and shows an account-management screen with an MFA configuration option.
- What you can do after
- Apply it via ASP.NET Core Identity by offering users authenticator-app setup and planning optional QR-code support.
Read how ASP.NET Core in Action, 3e explains multifactor authentication →
Acing the CCNA Exam: Volume 2 Advanced Networking and Security
Multifactor authentication is an identity-verification process that requires authentication factors from multiple categories before granting access.
- How it is used
- Frames MFA as a stronger alternative to username-and-password authentication and a password-policy concept.
- How deep it goes
- Explains the definition, security rationale, three factor categories, and valid combinations, but stops short of configuration or protocol implementation.
- Examples
- Uses passwords, PINs, badges, smartphones, SMS codes, authenticator apps, biometrics, badge readers, and fingerprint scans.
- What you can do after
- Evaluate authentication methods by classifying factors and determining whether combinations satisfy true MFA.
Microsoft Azure in Action
Multi-factor authentication (MFA) is an authentication technique that requires two or more independent types of evidence to verify an identity.
- How it is used
- Protects Azure sign-ins against weak, reused, or compromised passwords by requiring another authentication factor.
- How deep it goes
- Defines three factor types and outlines an Entra ID Conditional Access policy, including targets, grant requirement, and licensing.
- Examples
- Uses reused passwords, a phone-based sign-in prompt, and Entra ID authentication for Azure SQL to illustrate MFA.
- What you can do after
- Operate/configure it in the Azure Portal by creating an Entra ID Conditional Access policy that requires MFA.
Read how Microsoft Azure in Action explains multifactor authentication →
Data-Driven Cybersecurity
An authentication method requiring two or more independent factors to verify a user's identity.
- How it is used
- Reduces the risk of unauthorized access when passwords or credentials are compromised.
- How deep it goes
- Defines factor types and token options, including context-aware MFA, but does not give configuration steps.
- Examples
- Uses a remote-access breach and an IAM dashboard reporting 95% authentication success after improvements.
- What you can do after
- Operate/configure it for critical systems or remote access, then monitor access violations and authentication results.
Read how Data-Driven Cybersecurity explains multifactor authentication →
Software Security for Developers
Multifactor authentication verifies identity using two or more independent authentication factors.
- How it is used
- Deploys MFA for higher-risk logins and as a fallback authentication option in modern applications.
- How deep it goes
- Defines factor categories and explains password-plus-OTP flow, risks, rate limiting, monitoring, and safer OTP practices.
- Examples
- Uses password-plus-OTP login, authenticator apps, SMS codes, fingerprints, face scans, and security tokens.
- What you can do after
- Apply it via OTPs, authenticator apps, SMS codes, biometrics, or security keys while controlling replay and guessing risks.
Read how Software Security for Developers explains multifactor authentication →
Grokking Web Application Security
Multifactor authentication is an authentication technique that requires a user to provide at least two distinct forms of identification.
- How it is used
- Strengthens web logins by requiring an additional proof alongside a username and password.
- How deep it goes
- Explains factor choices, accessibility trade-offs, TOTP behavior, and WebAuthn registration safeguards without detailing a full server implementation.
- Examples
- Uses SMS codes, authenticator-app codes, push approvals, biometrics, and a browser WebAuthn credential-creation configuration.
- What you can do after
- Apply MFA by selecting accessible factors, recognizing SMS risks, and configuring WebAuthn biometric registration with replay-resistant challenges.
Read how Grokking Web Application Security explains multifactor authentication →
Azure Security
Multifactor authentication is an authentication method that requires two or more independent factors to verify an identity.
- How it is used
- Protects Azure identities by requiring additional verification when credentials may be compromised or sign-in risk is elevated.
- How deep it goes
- Defines factor types and demonstrates a Conditional Access policy, while deferring broader attack containment to layered Azure security services.
- Examples
- Uses brute-force risk, Bob's Azure sign-in, FIDO2 security keys, and a report-only Conditional Access policy.
- What you can do after
- Configure MFA through Microsoft Entra ID Conditional Access and test the policy in report-only mode before enforcement.
Read how Azure Security explains multifactor authentication →
MongoDB 8.0 in Action, Third Edition
MFA, or multifactor authentication, verifies an identity using two or more independent authentication factors.
- How it is used
- Assigns customers responsibility for configuring and enforcing identity protection when managing Atlas access.
- How deep it goes
- Explains MFA’s placement in shared responsibility and defense in depth, but does not provide a step-by-step configuration procedure.
- Examples
- Lists SMS, voice calls, authentication applications, YubiKey, and external identity providers as authentication examples.
- What you can do after
- Operate/configure Atlas UI access with added MFA and combine it with layered network, authentication, and authorization controls.
Read how MongoDB 8.0 in Action, Third Edition explains multifactor authentication →
Amazon Web Services in Action, Third Edition: An in-depth guide to AWS
Multifactor authentication is an authentication method that requires evidence from multiple independent credential factors.
- How it is used
- Protects AWS root-user and IAM-user sign-in against stolen or cracked passwords and access keys.
- How deep it goes
- Defines MFA and provides console enrollment steps for root users and IAM users, without covering token internals.
- Examples
- Uses a smartphone TOTP application, QR-code enrollment, virtual MFA devices, YubiKeys, and hardware tokens.
- What you can do after
- Operate/configure MFA for AWS root users and IAM users through the Management Console.
Related concepts
- Microsoft Entra IDused by · Microsoft Entra ID is Microsoft's cloud-based identity and access-management service for authenticating users, applications, and services and controlling their access to resources.
- authentication factoruses · An authentication factor is an independent category of evidence used to verify a subject’s identity during authentication.
- Keycloakused by · Keycloak is an open-source identity and access management platform that provides authentication, authorization, and single sign-on, including support for identity standards and federation.
- passwordless authenticationincludes · Passwordless authentication is an authentication method that verifies a user’s identity without requiring a conventional password.
- one-time codeused by · A one-time code is a temporary authentication credential accepted for a single attempt or operation, or during a limited validity period.
- inherence factoruses · An inherence factor is an authentication factor based on a distinctive biological or behavioral characteristic of the claimant.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.