Everyone approves a sign-in on their phone now. What does that second step cover?
Your email asks for a code or a phone approval each time someone signs in. Your provider turned it on, the owner has seen it working, and mostly that settles the question of a stolen password.
Multifactor authentication (MFA) is a check made at one moment: the sign-in. It says nothing about the method used, the accounts that were never enrolled, or what happens after the sign-in succeeds. This page names those edges so you can ask about each one.
What the second step does cover
CISA describes MFA as requiring two or more authenticators, drawn from something you know, something you hold, or something you are. If an attacker has one of them, such as a password, they can’t meet the second requirement. CISA’s own summary is that “any MFA is better than no MFA.”
A password that was guessed, or reused from another website, is the case it was built for.
Where it stops
- The method matters. Microsoft’s documentation says texted codes, emailed codes, and authenticator-app approvals are “prone to remote phishing attacks,” where a person types the password and the code into a page built to look real. Microsoft recommends methods that can’t be handed over that way: Windows Hello for Business, passkeys, security keys, and certificate-based sign-in. CISA says the only widely available phishing-resistant authentication is FIDO/WebAuthn.
- A prompt can be approved by mistake. CISA lists mobile push bombardment, a flood of approval requests until someone taps yes, as a weakness. Its suggested fallback is number matching, where the person types a number shown on the sign-in screen. Microsoft says number matching is on for all push notifications in its authenticator app.
- Older mail programs may not use it. Microsoft recommends blocking sign-in protocols that don’t support MFA, because a program that can’t ask for the second step can’t be made to.
- It covers accounts that were enrolled. Microsoft’s own policy guidance recommends excluding emergency-access accounts and service accounts, so accounts outside MFA exist by design. A shared mailbox and a former employee’s account are the other usual places to look.
- It checks the sign-in, not what comes after. A mailbox rule or forwarding address made during a sign-in keeps working once the session ends.
Five questions for your provider, with a date on each answer
- Which accounts have a second step registered, and which don’t? Ask for the list next to your current staff roster, including shared mailboxes and anyone who left.
- What method does each person use: a texted code, an app approval, a passkey, a security key? Ask first about the owner and anyone with administrator rights.
- Do app approvals require typing a number?
- Are older sign-in methods that can’t use a second step blocked, and when was that last checked?
- When someone loses a phone, who resets their second step, and how do they confirm the person asking is that person? Microsoft’s overview notes that help-desk resets that rely on identity questions carry a social engineering risk.
Reading the answers
A normal set of answers has a list that matches your roster, the owner and administrators on an app, passkey, or security key, number matching on, and older methods blocked with a date.
Signs that need a closer look: any account with a password and nothing else, a former employee’s account still enabled, a shared account with no second step, or an answer of “I think so” with no date.
You can also check one account yourself. Microsoft’s My Sign-ins page (Recent Activity) lists each sign-in with its location, device, and app. The location is estimated from the internet address, and mobile networks can show distant places, so judge the pieces together.
What we look at with you
We look at the sign-in methods and sign-in history for the accounts with you, and tell you what we found and what we didn’t, with dates. A person reads the result. A scan of a computer can’t see how a mailbox signs in, so this check starts in the account, not on the machine. A clean list covers what was examined on that date.
The second step was never meant to cover everything, so the useful question is how far it reaches in your business.
Related
Sources
- CISA: More than a Password
- Microsoft Learn: Microsoft Entra authentication overview
- Microsoft Learn: How number matching works in MFA push notifications
- Microsoft Learn: Block legacy authentication with Conditional Access
- Microsoft Support: View your work or school account sign-in activity from My Sign-ins
Talk to a person about what you noticed.
Call (•••) •••-••••
Kristina or Anne will answer. Available during US Eastern time.
While you wait: run the Reveal Scan on the computer you use for this.
Run the Reveal Scan on that computerThe Reveal Scan shows every problem it finds, with no charge and no credit card needed. Step-by-step instructions for fixing them are in the detailed report, which is paid, and you’ll see its price before you buy. It reads one Windows computer at a time and can’t see a mailbox.
Or ask for a call back. Tell us which computer or mailbox, and what you noticed.
Request a call back
Written by Craig Peterson, 35+ years successfully running IT and security for businesses. Last reviewed October 27, 2026.