MFA, or Multi-Factor Authentication, requires you to prove your identity in more than one way before you get in. A password is the first factor. The second factor is usually a code sent to your phone, an authenticator app, or a physical hardware key. It can also be a fingerprint or face scan.
A password alone can be stolen, guessed, or reused after a breach on another site. With MFA turned on, a stolen password is not enough for an attacker to get in. They would also need your phone or your key. For Microsoft 365, MFA costs nothing extra, and it is one of the largest security improvements a small business can make.
