MFA and Conditional Access
MFA (which includes Two-Factor Authentication (2FA) provides an additional layer of security for identifying a user by requiring the user to submit two or more elements for authentication. MFA is based on the following principles:
- Knowledge: Something that only the user knows, such as a password or pin.
- Possession: Something that only the user has, such as a code sent to a phone, a token, or a key.
- Inherent: Something that only the user is, such as biometrics.
Conditional Access works alongside MFA to provide more granular levels of access control; information is collected from the sign-in process (signals), and then decisions are made upon that information to determine whether access to the requested resource will be granted or denied and whether the user will require additional factors of authentication or require taking other action, such as resetting their password. This is visualized in the following diagram:
