Multi-factor authentication (MFA) strengthens authentication by requiring two or more independent factors before granting access: something you know (password), something you have (phone, hardware key), or something you are (biometrics).
Phishing-resistant passkeys and hardware security keys provide stronger protection than codes that users can relay to an attacker. TOTP authenticator apps are a common fallback; SMS may be necessary for accessibility or reach but should not be treated as the strongest option.
Plan enrollment and recovery together. A strong factor with a weak help-desk reset process still leaves the account exposed. Record factor changes in the audit log and require additional verification for sensitive actions.
See our authentication portal article for current patterns.