# What is multi-factor authentication (MFA)? Multi-factor authentication (MFA) checks who you are with two or more types of factor (something you know, have or are), so a password alone isn't enough. Updated: October 16, 2026 Multi-factor authentication (MFA) is a way of signing in that checks who you are with two or more different types of factor. ## What counts as multi-factor? NIST SP 800-63-4, the US government's digital identity guidelines, defines multi-factor authentication as using more than one distinct factor (section 2.3.1). Single-factor authentication uses just one, most often something you know. The types have to differ. NIST says two of the same factor still count as single-factor, and gives the example of a PIN you choose plus a password. Both are something you know. ## What are the factor types? - Something you know: a secret you remember, such as a password or a PIN. - Something you have: an object only you hold, such as a phone with an authenticator app (an app that shows a short code that keeps changing), a phone that gets text messages, or a security key (a small device you plug in or tap). - Something you are: a feature of your body, such as a fingerprint or face. The examples come from NIST and from CISA's guidance on MFA. NIST SP 800-63B-4 adds a limit in section 3.2.3: a biometric may be used only as part of multi-factor authentication together with a physical device, never alone. [What is two-step verification?](/guides/shared-accounts/what-is-two-step-verification) compares the common methods. ## Why do organizations require it? With a password alone, anyone who learns the password can sign in. A second factor of a different type means the password isn't enough on its own. CISA's guidance for businesses says strong passwords on their own are no longer enough to keep accounts safe, and that MFA can block many common attacks. CISA's Cybersecurity Performance Goals (CPG 2.0) include goal 3.F: require MFA, using the strongest method available, wherever a system offers it. Methods differ in strength. CISA ranks a security key as the best protection against phishing (fake sign-in pages that collect what you type). It ranks text or email codes as the weakest and says to use them only when nothing stronger is offered. ## What happens with a shared account? The second factor assumes one person holds it. NIST SP 800-63B-4 says in its introduction that users are responsible for keeping their sign-in secrets to themselves. Its protections target theft, not a user who hands a secret over on purpose. Its appendix on syncable authenticators adds that "different users are expected to maintain their own unique authenticators." When several people share one account and one authenticator app or phone number, the second factor shows only that someone on the team signed in. You can't tell which person it was. [Sharing two-step verification across a team](/guides/shared-accounts/sharing-two-step-verification) covers the choices you have. ## Frequently asked questions **Is two-step verification the same as multi-factor authentication?** Not always. Multi-factor means the checks use different types of factor. A password and a PIN are two steps but one factor, because both are something you know. **Is a code sent by text message multi-factor authentication?** The phone that gets the code is something you have, so a password plus a text code uses two types of factor. CISA ranks text and email codes as the weakest method and says to use them only when nothing stronger is offered. **Should we require MFA for our staff?** CISA's Cybersecurity Performance Goals ask organizations to require MFA, using the strongest method available, wherever a system offers it. CISA ranks a security key highest and text or email codes lowest. **What happens to MFA on a shared account?** The second factor is meant to belong to one person. NIST expects each user to keep their own sign-in device or app, so when a team shares one, a sign-in no longer shows who it was. ## Sources - [NIST SP 800-63-4, Digital Identity Guidelines](https://pages.nist.gov/800-63-4/sp800-63.html) - [NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (July 2025)](https://pages.nist.gov/800-63-4/sp800-63b.html) - [CISA: Require Multifactor Authentication](https://www.cisa.gov/secure-our-world/require-multifactor-authentication) - [CISA: Cybersecurity Performance Goals 2.0 (CPG 2.0)](https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0) ## How Junify handles this **Doing this by hand** Single sign-on and multi-factor authentication don't reach apps that can't connect to your identity provider, or accounts that stay shared. Those are left to manual work, and you have to track for yourself which accounts the tools cover. **With Junify** With Junify, each person confirms who they are before opening a shared account, by scanning a QR code on their computer screen with the Junify app on their own phone. If the account's own two-step verification uses an authenticator app, Junify enters that code too, and each use is recorded by person. Codes sent by text message or email aren't covered. Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when. - [Try the demo](https://www.junify.com/bpo/try?lang=en&from=guide&cluster=access-basics&slug=what-is-mfa) - [Book a 30-minute demo](https://www.junify.com/bpo/demo) ## More on this topic - [What's the difference between an audit log and audit evidence?](/guides/access-basics/audit-log-vs-evidence): An audit log is what a system records. Audit evidence is a log you can rely on: tied to a person, protected from change, kept for a set period, and reviewed. - [What a browser extension can and can't control in access management](/guides/access-basics/browser-extension-access-control-scope): An extension works inside the browser it's installed in, on the sites it's allowed to run on. Other apps, other browsers and other devices are out of its reach. - [What work data stays on a personal computer, and how to keep it off](/guides/access-basics/byod-leave-no-business-data): History, cookies, saved passwords, password manager copies and downloads. Pair company browser settings with logins that don't show people the password.