Multifactor Authentication (MFA) Overview

Body

MFA - Two Steps Ahead!

Securing your account with MFA requires you to understand the options that are available. Not all MFA is created equal; some are stronger (harder to circumvent) while others offers convenience. Finding the right balance is paramount.

Start with: "The Strength of MFA" to understand the three (3) types.

Then move on to: "Your Options" to see what is available under each type.

Don't forget: to have a secondary MFA method in the event you first choice is not available under "Choose Alternate MFA".

Finally finish with: registering an alternative email address in the event you forget your password.

The Strength of MFA

Microsoft defines three (3) categories of MFA effectiveness: weak, strong, and phishing resistant.

Strength	Explanation	Examples
Weak MFA	Requires two factors, but the second factor can potentially be intercepted, stolen, socially engineered, or relayed through a phishing site. It is still substantially better than password-only authentication.	SMS/Voice
Strong MFA	Removes the reusable password. Combines possession of a registered device with a PIN or biometrics. However, some methods are not device bound allowing for targeted phishing.	Microsoft Authenticator (push/passwordless)
Phishing-resistant MFA	Ties authentication to a specific device and service. Not easily bypassed by targeted phishing. A fake website cannot simply capture or relay the credential to Microsoft.	FIDO2 security keys such as YubiKey; https://www.amazon.ca/s?k=fido2 Microsoft Authenticator device-bound or synced passkeys.

Strength

Explanation

Examples

Weak MFA

Requires two factors, but the second factor can potentially be intercepted, stolen, socially engineered, or relayed through a phishing site. It is still substantially better than password-only authentication.

SMS/Voice

Strong MFA

Removes the reusable password. Combines possession of a registered device with a PIN or biometrics. However, some methods are not device bound allowing for targeted phishing.

Microsoft Authenticator (push/passwordless)

Phishing-resistant MFA

Ties authentication to a specific device and service. Not easily bypassed by targeted phishing. A fake website cannot simply capture or relay the credential to Microsoft.

FIDO2 security keys such as YubiKey; https://www.amazon.ca/s?k=fido2

Microsoft Authenticator device-bound or synced passkeys.

Your Options

TRU offers several MFA methods. Choose the strongest option from the list below that you can comfortably deploy. Methods are available for all students, faculty, and staff with a few exceptions.

/w exceptions #1: certain departments (such as IT), individuals, and roles are considered high-value targets for attackers. As a result, these users have been issued FIDO2 security keys (YubiKeys) by the Information Security department and are restricted to phishing-resistant MFA methods.

/w exceptions #2: Synced keys are not available on Windows 10 (Final Version: 22H2 October 2025 - no further feature updates). Those wishing to use synced keys should upgrade to Windows 11.

Rating	Availability	Primary Method	Comments
F	None	~~SMS/Voice~~ ^{strength: weak}	Discontinued as of Februrary 1, 2027. Microsoft is no longer allowing sms/voice as an MFA option. All users must have at least MS Authenticator before this date.
B / B+	All /w exceptions #(1)	MS Authenticator ^{strength: strong}	Minimum MFA. Various options available (ex: push notifications). Might still be susceptible to human error allowing MFA bypass through phishing.
B+ / A-	All /w exceptions #(1,2)	Synced keys ^{strength: (near) phishing resistant}	Convenient option. Can be a good choice If configured properly. Unlikely success of a phishing attack and especially useful to prevent "account lock-out". See related articles section for instructions on creating and using synced passkeys.
A-	All	MS Authenticator /w Passkey ^{strength: phishing-resistant}	Offers phishing resistant protection via a registered smartphone. However, can only log into devices with Bluetooth (mobile devices). Consequently, may make a better secondary MFA method in the event primary method is unavailable as you can still log into your smartphone and change your MFA settings if you need to.
A	All	FIDO2 ^{strength: phishing-resistant}	Best phishing resistant option. Works with any hardware device capable of FIDO2. https://www.amazon.ca/s?k=fido2

Choose Alternative MFA

Please set up least two (2) MFA authentication methods in the event one is not available (example: you purchase a new phone but your MS Authenticator is registered with your old phone). By selecting a complementary secondary authentication method, you would still be able to log in and update your settings. Below are good combinations of primary and secondary MFA.

Rating	Availability	Primary Method	Secondary Method	Comments
A-	All /w exceptions #(1)	MS Authenticator ^{strength: strong}	Synced keys ^{strength: (near) phishing resistant}	Good combination of MFA protection and convenience (when synced keys configured correctly).
A	All /w exceptions #(1,2)	FIDO2 ^{strength: phishing-resistant}	Synced keys ^{strength: (near) phishing resistant}	Very good combination of MFA protection (phishing resistant) and convenience.
A	All /w exceptions #(1)	FIDO2 ^{strength: phishing-resistant}	MS Authenticator ^{strength: strong}	Very good combination when FIDO2 is always used except in an emergency.
A	All /w exceptions #(1,2)	MS Authenticator /w Passkey ^{strength: phishing-resistant}	Synced keys ^{strength: (near) phishing resistant}	Synced keys option not available for some departments or positions.
A+	All	FIDO2 ^{strength: phishing-resistant}	MS Authenticator /w Passkey ^{strength: phishing-resistant}	Strongest combination. Both primary and secondary methods are phishing resistant. Available to all staff including specialized departments and/or roles.
A+	All	FIDO2 (#1) ^{strength: phishing-resistant}	FIDO2 (#2) ^{strength: phishing-resistant}	Strongest combination. Configure two different FIDO2 keys. Keep one as a spare in the event of loss of the other. Available to all staff including specialized departments and/or roles.
A+	All	MS Authenticator /w Passkey (#1) ^{strength: phishing-resistant}	MS Authenticator /w Passkey (#2) ^{strength: phishing-resistant}	Strongest combination. Configure an Authenticator passkey on two (2) different smart phones. Available to all staff including specialized departments and/or roles.

Provide a Password Reset Alternative Email

Add an alternative email to your profile. This will allow you to reset your password in the event you forget it.

1. Go to https://mysignins.microsoft.com/security-info

2. Select +Add a Sign-In Method then select EMAIL

3. Enter your personal email address to send reset password codes to.

Details

Article ID: 16739

Created

Mon 9/14/26 12:45 PM

Modified

Mon 10/5/26 3:29 PM

Multifactor Authentication (MFA) Overview

Body

MFA - Two Steps Ahead!

Details

Details

Related Articles

Related Articles (1)