Multi-factor authentication

The plain version first. Microsoft describes multifactor authentication as working by requiring two or more of the following authentication methods: something you know, typically a password; something you have, such as a trusted device that's not easily duplicated, like a phone or hardware key; and something you are, meaning biometrics like a fingerprint or a face scan. Two of those, from different rows.

The standard turns that into levels, and the levels hold the useful detail. AAL2 provides high confidence that the claimant controls one or more authenticators bound to the subscriber account being authenticated. At that level, proof of the possession and control of two distinct authentication factors is required. One more sentence is worth carrying into a supplier conversation: applications assessed at AAL2 must offer a phishing-resistant authentication option. A level below, it is only recommended that applications assessed at AAL1 offer multi-factor authentication options. A level above, AAL3 authentication requires a phishing-resistant authenticator.

So the word covers a wide range. One vendor's own list of verification methods includes an authenticator app, Windows Hello for Business, passkeys, certificate-based authentication, hardware and software one-time-password tokens, a text message and a voice call. Every one of those lets a supplier answer yes to the question of whether they support MFA, and they are not equivalent.

One practical detail sits in the same vendor documentation. You do not need to change apps and services to use it. The verification prompts are part of the sign-in, which automatically requests and processes the challenge when needed. So for software built on a mainstream identity provider, this is usually a configuration decision rather than a development project. That changes both the cost and the timeline of doing something about it.