Multifactor authentication

As explained in Azure Security

Multifactor authentication is an authentication method that requires two or more independent factors to verify an identity.

Multifactor authentication (MFA) verifies an identity with a second proof beyond a username and password. It reduces the chance that disclosed credentials alone can provide access. section 2.2.1 section 2.2.2

Common authentication factors include:

• Something you know, such as a password or PIN. section 2.2.2
• Something you have, such as a mobile phone, identity card, or FIDO2 security key. section 2.2.2
• Something you are, such as a fingerprint or retinal scan. section 2.2.2

Microsoft Entra ID can detect suspicious logins and enforce MFA. Conditional Access can require it for selected users, workload identities, cloud apps, or elevated sign-in risk. section 1.8.1 section 2.12

Require MFA for elevated sign-in risk

In Azure Active Directory, open Security > Conditional Access, create a policy named Require MFA for Elevated Sign-In Risk, assign it to Bob and all cloud apps, select Grant Access with Require Multifactor Authentication, and initially set Enable Policy to Report-Only. section 2.12

Figure 1.5 Azure security services that can be used to secure identities in your Azure environment

Trace how MFA fits with identity protection, Microsoft Sentinel, and other Azure security services across an attack sequence. section 1.8.1

How Azure Security covers it

How deep it goes

Defines factor types and demonstrates a Conditional Access policy, while deferring broader attack containment to layered Azure security services.

Examples

Uses brute-force risk, Bob's Azure sign-in, FIDO2 security keys, and a report-only Conditional Access policy.

What it assumes

Assumes familiarity with Azure identities and Azure Active Directory while introducing authentication factors from basic credential risks.

What you can do after

Configure MFA through Microsoft Entra ID Conditional Access and test the policy in report-only mode before enforcement.

How it connects

Connects MFA with Microsoft Entra ID, Conditional Access, identity protection, Azure RBAC, Privileged Identity Management, and Microsoft Sentinel.

liveBookmanning.com

Read Azure Security on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  ASP.NET Core in Action, 3eMultifactor authentication is authentication that requires evidence from multiple independent credential or verification factors.
• 

  liveBookmanning.com
  Acing the CCNA Exam: Volume 2 Advanced Networking and SecurityMultifactor authentication is an identity-verification process that requires authentication factors from multiple categories before granting access.
• 

  liveBookmanning.com
  Microsoft Azure in ActionMulti-factor authentication (MFA) is an authentication technique that requires two or more independent types of evidence to verify an identity.
• 

  liveBookmanning.com
  Data-Driven CybersecurityAn authentication method requiring two or more independent factors to verify a user's identity.
• 

  liveBookmanning.com
  Software Security for DevelopersMultifactor authentication verifies identity using two or more independent authentication factors.
• 

  liveBookmanning.com
  Grokking Web Application SecurityMultifactor authentication is an authentication technique that requires a user to provide at least two distinct forms of identification.
• 

  liveBookmanning.com
  MongoDB 8.0 in Action, Third EditionMFA, or multifactor authentication, verifies an identity using two or more independent authentication factors.
• 

  liveBookmanning.com
  Amazon Web Services in Action, Third Edition: An in-depth guide to AWSMultifactor authentication is an authentication method that requires evidence from multiple independent credential factors.

Compare how 9 books explain multifactor authentication →

Related concepts

• Microsoft Entra IDused by · Microsoft Entra ID is Microsoft's cloud-based identity and access-management service for authenticating users, applications, and services and controlling their access to resources.
• authentication factoruses · An authentication factor is an independent category of evidence used to verify a subject’s identity during authentication.
• Keycloakused by · Keycloak is an open-source identity and access management platform that provides authentication, authorization, and single sign-on, including support for identity standards and federation.
• passwordless authenticationincludes · Passwordless authentication is an authentication method that verifies a user’s identity without requiring a conventional password.
• one-time codeused by · A one-time code is a temporary authentication credential accepted for a single attempt or operation, or during a limited validity period.
• inherence factoruses · An inherence factor is an authentication factor based on a distinctive biological or behavioral characteristic of the claimant.

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.