A username and password are only one authentication factor. If someone gets both, they can try to sign in as you. Multifactor authentication (MFA) asks for at least one more kind of evidence before granting access, making reused or compromised passwords less useful to an attacker. section 6.5
MFA combines at least two of these three types of evidence:
- Something you know, such as a username and password. section 6.5
- Something you have, such as a phone with an authenticator app or a hardware security key. section 6.5
- Something you are, such as a fingerprint or face scan. section 6.5
In Azure, Entra ID manages MFA for identities. To set a requirement in the Azure Portal, open Entra ID → Security → Conditional Access and create a policy. Define the users or groups and target application, then set the grant requirement to allow access only after MFA. Check the account prompt to see the requirement in action; one illustrated prompt offers text-message or phone-call confirmation. This configuration requires Entra ID Premium P1 or equivalent rather than the free version, so watch the billing date if you use a trial. section 6.5 section 6.9
Protecting database access
For an Azure SQL database, Entra ID authentication can bring MFA into the sign-in path. Role-based access control (RBAC) handles a different question: what an authorized identity may access. The combination helps keep database access tied to centrally managed users rather than separate SQL credentials. section 10.6.1
MFA strengthens Azure’s identity layer of defense in depth; it does not replace decisions about who should have access. Passwordless authentication is described as a related MFA approach that relies on hardware keys or biometrics instead of passwords users must remember. section 6.1.1 section 6.9
