How Our Two-Factor Authentication (2FA) Works

Second factors are enrolled per user account and their coverage is verified account by account, since the common failure is not that the mechanism is weak but that it applies to fewer accounts than anyone believes. A configuration that appears enabled globally can be scoped by a condition that exempts most users, so enrolment is confirmed against the actual list of accounts rather than against the setting. App-based time-based one-time passwords or hardware security keys are preferred, with SMS used only where nothing better is supported, because SMS is vulnerable to number takeover. Recovery codes are generated, delivered once and stored securely, and the account recovery path is examined as carefully as the login path, since a weak reset flow bypasses the second factor entirely. Shared and service accounts are eliminated or given a documented custodian, because a shared secret cannot be attributed. Session lifetime and device trust duration are set explicitly. Enrolment is tested by signing in as each role, and the state is documented with the date it was verified.