What is MFA?

Multi-factor authentication (MFA) is an authentication method that requires a user to present two or more independent proof-of-identity factors – something they know, such as a password, something they have, such as a one-time code or device certificate, or something they are, such as a biometric – before access is granted.

Key takeaways

• MFA requires two or more independent proofs of identity, not just a password.
• Common factors: passwords, one-time codes, device certificates, biometrics.
• A stolen password alone is not enough to grant access under MFA.
• Versa supports MFA via TOTP, email OTP, and device-certificate profiles.
• Trusted-IP and local-breakout design choices affect how often MFA prompts fire.

On this page: Why it matters · How it works · Types · MFA & Versa · FAQ

Why is MFA important?

Passwords alone are a weak gate: they get phished, reused, guessed, or leaked in breaches, and once an attacker has one, a password-only system has nothing left to check. MFA closes that gap by requiring a second, independent proof an attacker rarely possesses even after stealing credentials – a code from a device the real user holds, or a certificate bound to a known machine.

That matters more as work moves off the corporate network. Remote users, branch offices, and cloud applications all authenticate over the open internet, where credential-stuffing and phishing are constant. MFA is one of the highest-return controls available: analysts attribute most successful account-takeover attacks to a missing second factor. It is also foundational to Zero Trust, which assumes no connection is trustworthy by default and verifies identity continuously before granting access.

What is MFA?

MFA combines factors from at least two of three categories. Knowledge factors are something the user knows, such as a password or PIN. Possession factors are something the user has, such as a phone generating a one-time password, an SMS or email code, or a certificate on a registered device. Inherence factors are something the user is, such as a fingerprint or face scan.

A typical flow starts with a primary credential – a username and password, or a directory login – then challenges the user for a second factor before the session is authorized. The factor requested can depend on context: a known device may be challenged less often than an unfamiliar one, a pattern called adaptive authentication. Either way, no single stolen credential is sufficient on its own.

Types of MFA

Implementations vary in which second factor they use and how it reaches the user. SMS or email OTP sends a short code to a registered phone or inbox – easy to deploy, but dependent on the channel’s security. TOTP generates a code locally in an authenticator app from a shared secret and the current time, avoiding network delivery entirely. Push notification sends an approve/deny prompt to a mobile app instead of a typed code. Hardware or FIDO security keys use public-key cryptography bound to a device, resisting phishing far better than a typed code. Device-certificate authentication verifies a certificate on a known machine, usually alongside a credential. Biometrics – fingerprint or face – are typically a local unlock layered on top of one of the above.

MFA & Versa

Versa applies MFA across its management and access surfaces. On Versa Director, administrators can enable two-factor authentication per user, with login followed by a code delivered by email or SMS; Director does not natively support FIDO, so organizations needing phishing-resistant authentication pair it with SSO to a FIDO-capable identity provider, passing that assurance through to Director, Concerto, and the SASE Client.

For remote users, MFA is built into the SASE client registration flow: the client can require a time-based one-time password or an emailed code before registration completes, configured through the secure client-based access rule’s MFA toggle, with TOTP delivered as a scannable QR code.

MFA also interacts with network design. The Azure Active Directory and MFA integration guide shows how local internet breakout can multiply the trusted-IP addresses an identity provider must track; routing authentication traffic centrally while breaking out other SaaS traffic locally keeps MFA exceptions manageable without losing that performance benefit.

Frequently asked questions

Is MFA the same as two-factor authentication (2FA)?

2FA is a specific case of MFA that uses exactly two factors. MFA is the broader term and can involve more – for example, a password, a TOTP code, and a device certificate together. Every 2FA setup is MFA; not every MFA setup is limited to two.

What are the three main categories of authentication factors?

Knowledge (something you know, like a password), possession (something you have, like a phone generating a code or a certificate on a registered device), and inherence (something you are, like a fingerprint or face scan). MFA combines factors from at least two categories.

Does Versa Director support FIDO-based MFA natively?

No. Versa Director’s built-in two-factor authentication delivers a code by email or SMS. For FIDO or other advanced methods, Director must be paired with SSO to an identity provider that supports FIDO, which then passes that stronger authentication through to Director, Concerto, and the SASE Client.

How does the Versa SASE Client use MFA?

During registration, the SASE Client can require a second factor – a time-based one-time password from an authenticator app or a code emailed to the user – before registration completes. Gateway-to-client policy can also enforce MFA as a condition of the connection stage.

Can an organization reduce MFA prompts without weakening security?

Yes, using trusted-IP exceptions: identity providers can bypass MFA for traffic from known, trusted addresses, such as a data center. Versa Secure SD-WAN supports this by routing authentication traffic centrally while breaking out other SaaS traffic locally, keeping the trusted-IP list small.

More on MFA

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about MFA, these are worth looking at next.