Azure Multi-Factor Authentication helps protect access to your data and applications, all the while keeping it easy for users. It provides additional security by requiring a second form of authentication and deliver strong authentication via a range of easy-to-use authentication methods. Those authentication methods can be called to the phone. This will automatically call the registered phone number with MFA. The user will need to answer and select a pound key to verify, or SMS message to the phone. 

This will send a text message to the user containing the verification code. The user will then need to answer the code at the sign in interface, or notification through the authenticator app. This will send a push notification to the Microsoft Authenticator app on the user's mobile phone. The user can accept the push notification to verify. And lastly, a verification code from a mobile app or hardware token. This will prompt the user to enter a verification pin. The user will need to launch the Microsoft authenticator app and enter the pin that is presented to them. The pin expires after 30 seconds and a new one will be generated. Within Azure Multi-Factor Authentication many options can be configured by the administrator to better customize the user experience.

 The organization can determine what authentication method we mentioned earlier to allow. If for example, SMS messages are considered a security risk, then this option can be turned off. Fraud alerts can be configured so that the users can report fraudulent attempts if they receive a two-step verification request that they didn't initiate. A one-time bypass code can be used to sidestep the two-step verification for a limited time. An example of this would be if an employee lost her phone. Lastly, we will look at trusted IP's for managed and federated tenants to bypass the two-step verification when they're in a trusted location such as company officials.