What is multi-factor authentication in a cloud service?¶
Multi-factor authentication requires more than one type of proof before access is allowed.
That might combine a password with an authenticator-app code, push approval, security key, biometric check or trusted device.
What this means in practice¶
A second factor can be compromised, shared or bypassed. A user may approve a fraudulent push notification. An attacker may steal a session after authentication. A recovery process may allow access without the usual factor. A trusted device may reduce the checks required.
But the meaning depends on the method.
In an organisational environment, the identity provider may hold the detailed multi-factor records rather than the cloud service itself.
What this may show¶
Multi-factor records can still strengthen an attribution enquiry. They may show which method was used, whether a challenge was sent, whether it succeeded, which device or token was involved and whether the event triggered a security alert.
What this does not show on its own¶
The dangerous assumption is that multi-factor authentication proves the named user personally approved the login.
A hardware security key may provide stronger evidence of possession than an SMS code. A push approval may show that a registered device accepted the request, but not who pressed the button. A biometric check may occur locally on the device and may not be visible to the cloud provider.
What to do next¶
Check whether the event was a fresh authentication, a remembered session, token refresh or application access. Multi-factor may have been completed earlier and not repeated for the later activity.
Do not describe multi-factor as impossible to defeat. Treat it as a security control and evidential indicator, not conclusive proof of identity.
Key takeaway
Multi-factor authentication can strengthen the evidence about how access was approved, but it does not remove the need to identify the device, session and person involved.