MFA and authentication methods policy, phishing-resistant methods (FIDO2, passkeys, Windows Hello), authentication strengths

Multifactor authentication (MFA) requires two or more of: something you know (password or PIN), something you have (phone, security key) and something you are (fingerprint, face). A stolen password alone is then not enough. In Microsoft Entra ID you can require MFA through security defaults (a free, all-or-nothing baseline) or, for finer control, through Conditional Access policies. The old per-user MFA setting is legacy and should be avoided in favor of Conditional Access.