By Mike Chen, Director of IT Solutions · January 15, 2025

Multi Factor Authentication Best Practices: What Actually Works in 2025

TL;DR: MFA Best Practices in Under 55 Words

Phishing-resistant MFA (FIDO2/WebAuthn hardware keys) is the gold standard. SMS OTP is the floor, not the ceiling. SOC 2 CC6.1, HIPAA 164.312(d), and CMMC IA.3.083 all expect MFA on privileged access. Per CISA's 2022 phishing-resistant MFA fact sheet, only FIDO2 and PKI methods resist modern attacks. Not all MFA is equal.

NIST SP 800-63B defines three Authenticator Assurance Levels. AAL1 is single-factor, AAL2 covers TOTP and push, AAL3 demands a hardware cryptographic authenticator. If you're enforcing MFA but still using SMS for admins, you're at AAL1 in practice.

How Attackers Actually Bypass Common MFA Methods

I've worked breach response on cases where the customer swore they had MFA on every account. They did. The attackers still got in. Here's how.

SIM swapping. The attacker calls a mobile carrier, social-engineers a porting request using leaked personal data, and within an hour the victim's number rings on the attacker's SIM. SMS OTPs flow straight to the bad guy. FBI IC3 reported $72 million in SIM-swap losses in 2022 alone.

MFA fatigue (MFA bombing). The attacker has the password and spams push notifications at 2am until the exhausted user taps Approve. This is the documented vector in the September 2022 Uber breach, where the contractor approved a push prompt after being pestered for over an hour, per Uber's own post-incident statement.

Adversary-in-the-middle (AiTM) proxies. Tools like Evilginx2 (publicly available on GitHub) and Modlishka act as reverse proxies between the user and the real login page. The user enters credentials and the TOTP code on what looks like Microsoft 365. The proxy passes both upstream, completes the login, and captures the session cookie. Microsoft Threat Intelligence reported in 2022 that one AiTM phishing campaign hit over 10,000 organisations. TOTP and push are both defeated post-authentication, because the attacker steals the cookie, not the second factor.

SS7 protocol exploits. Telecom signalling protocol weaknesses let attackers intercept SMS at the network layer without ever touching the SIM. Nation-state and organised crime territory, but real.

Map this against your stack:

• SMS OTP: defeated by SIM swap, SS7, AiTM
• TOTP app: defeated by AiTM
• Push notification: defeated by MFA fatigue and AiTM
• FIDO2 hardware key: not defeated by any of the above

That last line is why CISA recommends phishing-resistant MFA for any high-value account.

MFA Method Comparison: Decision Matrix

*Synced passkeys generally meet AAL2; device-bound hardware passkeys can meet AAL3.

A few notes from the field. Okta enabled mandatory number-matching for Okta Verify push in 2023, and Microsoft did the same for Authenticator. If you run push MFA and haven't switched on number-matching plus additional context (geolocation, app name), do it before you finish reading this article. It's a free setting and it kills the majority of fatigue attacks.

YubiKeys cost roughly $55 each at Yubico's current public pricing. For a 100-person company that's $5,500 once, with a refresh every 4 to 5 years. That's less than two months of a single $6/user/month push licence.

Compliance-Specific MFA Requirements You Cannot Miss

This is where I see auditors leaving fingerprints.

SOC 2 CC6.1. Logical access controls. Auditors now routinely flag missing MFA on admin consoles, VPN, and any remote access. The control text doesn't say "MFA" explicitly, but a Type II report without MFA on privileged accounts will draw a qualified opinion in 2025.

HIPAA 164.312(d). Person or entity authentication. The text predates modern MFA, but OCR's enforcement posture and the 2024 proposed Security Rule updates make MFA the de facto requirement for ePHI access.

CMMC Level 2 IA.3.083 (mapped to NIST SP 800-171 control 3.5.3). Explicitly requires MFA for local and network access to privileged accounts, and network access to non-privileged accounts. No interpretation needed. It's in the text.

PCI DSS v4.0 Requirement 8.4. MFA required for all access into the cardholder data environment. The future-dated requirements became mandatory on 31 March 2025. If you process card data and your warehouse staff log in with a password only, you're out of compliance now.

Cyber insurance. Coalition, Corvus, and Chubb have all publicly stated phishing-resistant MFA on email and remote access is a condition of coverage, not a discount. Coalition's 2024 Cyber Claims Report confirms claims involving missing or weak MFA see materially higher payouts. See the full list of controls carriers check in our 2026 cyber insurance requirements guide.

Service accounts are the usual blind spot. They get carved out of the MFA policy because something breaks otherwise, and then nobody revisits the exception. Auditors look for exactly that, because an unreviewed exception is where a control quietly stops applying. "Compliant" without evidence is just a word.

MFA for Non-Standard Environments

Standard guides cover user logins. Real environments are messier.

Service accounts. They can't interactively type a code. Don't try to force MFA there. Use short-lived credentials, workload identity federation (AWS IAM Roles Anywhere, Azure Managed Identity, GCP Workload Identity), and vault static secrets in a PAM tool. CyberArk and BeyondTrust run mid-market deals in the $50K to $150K/year range for typical 50-300 user environments. HashiCorp Vault is open-source free, with HCP Vault starting around $0.03 per secret per hour for managed.

APIs. OAuth 2.0 with short-lived tokens. Rotate via a secrets manager. Never hardcode keys in CI/CD.

CI/CD pipelines. GitHub Actions and GitLab both support OIDC-based ephemeral tokens to cloud providers. This eliminates the long-lived API key entirely. No credential equals no credential to steal.

Shared workstations. Manufacturing floors and nursing stations don't support 1:1 device binding. Use smart cards (PIV/CAC) or YubiKey Bio with FIDO2, which let you tap a personal token to a shared machine. HID Global cards are common in healthcare.

OT/ICS. Don't try to put MFA on the PLC. Put MFA at the IT/OT boundary, on the jump server or bastion host. CISA's ICS guidance backs this approach.

PAM checkout. Require MFA when the credential is checked out of the vault, not just at the user's SSO login. Otherwise an attacker who has SSO can pull every privileged credential without a second prompt.

MFA is a common site for accidental duplication. Duo, Okta Verify, and a separate TOTP app running across overlapping user populations is a familiar picture, and each one adds licence cost plus another enrolment path the help desk has to support. One method per population is cheaper to run and far easier to evidence.

MFA Rollout Failures: What Goes Wrong

Microsoft's 2023 Digital Defense Report stated only about 38% of Microsoft Entra ID accounts had MFA enabled (up from 27% the prior year). It's growing, but if you assume "we rolled it out" means "everyone uses it," you're wrong.

Failure modes I see weekly:

• Helpdesk meltdown on day one. Pilot with IT first, then a friendly department, then the rest.
• Legacy apps that don't speak modern auth. Either front them with an MFA proxy (Duo Network Gateway, Okta Access Gateway) or replace them. App passwords are a backdoor, and Microsoft is phasing them out.
• Executive exemptions. This is the single biggest audit finding I see. The CFO doesn't get to skip MFA. Period.
• Registration vs enforcement gap. Users registered for MFA isn't the same as users required to use MFA. Track both numbers separately.

Use conditional access (Entra ID) or Okta sign-on policies to stage rollout by group, location, and risk signal. That's risk-based authentication, and it's the difference between a clean go-live and a flood of tickets.

Phishing-Resistant MFA and the Road to Passwordless

CISA's October 2022 fact sheet "Implementing Phishing-Resistant MFA" defined the term clearly: only FIDO2/WebAuthn and PKI-based methods qualify. SMS, TOTP, and push do not.

WebAuthn. Browser-native W3C standard. The private key stays on the authenticator (YubiKey, TPM, Secure Enclave). The server only ever sees a cryptographic signature scoped to the origin. A spoofed domain gets a signature that's invalid for the real domain. That's why FIDO2 beats AiTM.

Passkeys. Apple, Google, and Microsoft now sync passkeys across devices via their respective accounts. Convenient. Slightly lower assurance than hardware-bound FIDO2 because the key material is recoverable from a cloud account. For most users, synced passkeys are a huge upgrade. For admins, stick with hardware-bound.

Passwordless today. Microsoft 365 and Google Workspace both support passwordless sign-in with Windows Hello for Business, Touch ID, or a FIDO2 key. You can deploy this now.

Post-quantum. NIST published FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) in August 2024. Current FIDO2 uses ECC and RSA, which are quantum-vulnerable in the long term. The FIDO Alliance is tracking migration. Don't panic, don't wait. Deploy FIDO2 now, plan post-quantum migration alongside your broader cryptography refresh.

Practical roadmap: FIDO2 for admins and privileged accounts this quarter. Passwordless for general users over the next 12 to 18 months.

Quick-Start MFA Implementation Checklist

1. Inventory every identity provider and app. Find SSO gaps and local-auth holdouts.
2. Classify accounts: privileged, remote access, standard, service. Apply tiered MFA policy.
3. Turn on number-matching and additional context for any push MFA today.
4. Enforce FIDO2 for all admin and privileged accounts before anything else.
5. Disable SMS OTP for admins. Set a deprecation date for all user SMS OTP.
6. Audit PAM. Are service account credentials rotated, vaulted, and MFA-gated at checkout? Pair MFA enforcement with a strong enterprise password management solution to close the remaining credential gaps.
7. Track MFA registered vs MFA enforced as separate metrics.
8. Document coverage percentage. Present it to auditors before they ask.

Reference: NIST SP 800-63B for the authoritative controls. OWASP MFA Cheat Sheet for implementation patterns.

If you're within 90 days of a SOC 2 or HIPAA audit and don't know where you stand on MFA coverage, book a free 30-minute audit with Mike. He'll tell you exactly which accounts are exposed and what auditors will flag first.

Frequently Asked Questions

Is SMS MFA better than no MFA? Marginally, yes. It stops credential stuffing and password spray. It doesn't stop SIM swap, SS7 interception, or AiTM. Use SMS only as a fallback for low-risk accounts, never for admins.

Does MFA satisfy SOC 2 CC6.1? MFA is a key control but not the only one. Auditors also examine session management, access reviews, and privileged account governance. MFA without quarterly access reviews still gets you a finding.

What MFA method does NIST recommend? NIST SP 800-63B AAL2 accepts TOTP and push with number-matching. AAL3, required for high-value federal systems and recommended for privileged access generally, requires a hardware cryptographic authenticator such as FIDO2 or a smart card.

How do I handle MFA for shared accounts? You shouldn't have shared accounts. If unavoidable (legacy ICS, kiosk), use PAM with MFA at vault checkout and full session recording. Each human user authenticates to the vault, then the vault brokers the shared credential.

Can attackers bypass FIDO2? Current phishing and AiTM attacks cannot bypass FIDO2 because the credential is origin-bound. A spoofed site receives a cryptographic proof that's invalid for the real site. OWASP's MFA Cheat Sheet documents this property. Future attacks may target endpoint malware or quantum cryptanalysis, but neither defeats deployed FIDO2 today.