IAM

MFA Is Not Enough: Why Context-Aware Authentication Is the Real Standard

What Is It?

Multi-factor authentication (MFA) requires users to verify their identity using more than one factor — typically something they know (password), something they have (phone or hardware token), or something they are (biometrics). For years, MFA has been positioned as the gold standard of identity security.

Context-aware authentication goes further. It doesn't just ask who are you — it asks who are you, where are you, what are you using, and does this request look normal? It evaluates the full context of an access attempt before making a trust decision.

Why Does It Matter?

MFA is highly effective, but it's not unbreakable. Adversary-in-the-middle (AiTM) attacks, MFA fatigue attacks, and SIM-swapping have all been used to bypass MFA in real-world breaches. Attackers have adapted — and so must defenses.

Context-aware authentication addresses these gaps by treating every login as a risk signal, not just an identity check. A legitimate user logging in from their usual device, location, and time of day is a very different event than the same credentials appearing from a Tor exit node at 3am.

How Does It Work?

Context-aware authentication pulls multiple signals into the access decision:

Signal	Example
Location	Known office IP vs. anonymous proxy
Device	Managed, Entra-joined device vs. unknown personal device
Time	Business hours vs. 2am access attempt
User risk	Clean history vs. flagged leaked credentials
Sign-in risk	Normal pattern vs. impossible travel detected

In Microsoft Entra ID, this is implemented through Identity Protection (which calculates risk scores) combined with Conditional Access (which acts on those scores). A high-risk sign-in can trigger step-up MFA, require a compliant device, or block access entirely — automatically, in real time.

Real-World Example

An employee's credentials are compromised in a third-party data breach. An attacker attempts to log in using those credentials from Eastern Europe. The employee's Entra ID tenant has Identity Protection enabled — the sign-in is immediately flagged as high risk (leaked credentials + unfamiliar location). Conditional Access automatically blocks the attempt and forces a password reset before any access is granted.

Without context-aware controls, MFA alone might not have caught it — especially if the attacker used an AiTM proxy to relay the MFA response in real time.

Best Practices

Enable Microsoft Entra ID Protection to get real-time risk signals on every sign-in
Build risk-based Conditional Access policies — require stronger auth when risk is elevated
Use phishing-resistant MFA (FIDO2/passkeys or certificate-based auth) for privileged accounts
Don't treat MFA as the finish line — layer it with device compliance and location awareness
Monitor MFA fatigue patterns — repeated push notifications to the same user is a red flag
Educate users on what legitimate MFA prompts look like and when to report unexpected ones

Key Takeaway

MFA raises the bar — but context-aware authentication is what actually enforces Zero Trust. Know who the user is and whether this specific request makes sense.

Quimirr Heyward is an IAM specialist with 7+ years in Risk Management and Compliance. He writes about identity security at QuimirrHeyward.com.