JoeLearns Logo
JoeLearns
Sharpen Skills & Keep Growing

Topics

/

Cybersecurity

/

Security Concepts

Security Concepts

Understanding MFA

Episode 1

ConceptAvailable10 min

A beginner-friendly introduction to multi-factor authentication, including what it is, the main authentication factor types, common MFA methods, and why some forms of MFA are stronger than others.

Lesson Details

Series
Security Concepts
Published
2026-04-05
Topic
Cybersecurity
Format
Concept

Key Concepts

What this lesson covers

MFA requires more than one form of verification before access is granted.
Authentication factors usually fall into three categories: something you know, something you have, and something you are.
Common MFA methods include authenticator app prompts, one-time codes, SMS, hardware keys, biometrics, and passkeys.

Why It Matters

Why this matters in practice

Passwords alone can be guessed, stolen, reused, leaked, or phished.
MFA adds an important layer of protection that helps reduce the risk of account compromise.
Understanding MFA creates a strong foundation for identity, access, and platform-specific security topics later.

Follow Along

Video outline

Use this outline while watching to follow the flow of the lesson and keep track of the most important MFA concepts.

1
What MFA is and why it exists
2
Why passwords alone are weak
3
The three main authentication factor categories
4
Something you know
5
Something you have
6
Something you are
7
Common real-world MFA methods
8
Authenticator apps and one-time codes
9
SMS, voice, and hardware-based methods
10
Biometrics and passkeys
11
Why not all MFA is equally strong
12
Common misconceptions around MFA
13
Why MFA matters across modern IT
14
Where this leads next in identity and access management

Key Takeaways

Make note of these

MFA means more than one factor

Multi-factor authentication is about requiring more than one type of verification before access is granted, not just adding extra steps for the sake of it.

The factor categories matter

Something you know, something you have, and something you are are the core categories that help define whether a login experience is actually multi-factor.

Two steps does not always mean true MFA

If both checks come from the same factor category, that is not really the same thing as combining different authentication factors.

Not all MFA methods are equally strong

SMS-based MFA is still better than no MFA, but stronger and more phishing-resistant options exist, including authenticator apps, security keys, and passkeys.

MFA reduces risk, not all risk

It is one of the most important protections we have for accounts, but it should be understood as part of a broader security strategy, not a perfect defense.

This is the foundation for platform-specific learning

Once the concept of MFA makes sense on its own, it becomes much easier to understand how platforms like Microsoft Entra ID plan, enforce, and manage it.

Next Step

Take the concept into practice

Once you understand MFA as a concept, the next step is seeing how it gets planned and enforced in a real platform. The follow-up lesson moves into Microsoft Entra ID and covers Security Defaults, Per-User MFA, Conditional Access, licensing considerations, and rollout strategy.