A security questionnaire lands on your desk and asks how your organization verifies the people who sign in. Answering it is straightforward. Choosing the two factor authentication options you will live with is the part that takes a decision, and it is often made when the account is first set up.
There are three two factor authentication options in Kohezion. Comparisons tend to rank them by which is hardest to defeat, and that is rarely what decides the outcome. What decides it is whether the people who have to use it every day can do so without inventing a workaround.
What are the two factor authentication options?
An authenticator app produces a rotating code on the person's phone. An emailed code arrives in their inbox when they sign in. A passkey uses the device in their hand, and is available on Enterprise accounts.
The first two sit after the password. A passkey works either way. It can strengthen the password as a second step, or stand in for it entirely, and we take that choice up in our piece on passkey sign-in. Each person enrols their own passkeys, up to ten of them.
What does each one ask of your people?
No feature list answers this one, and each method puts its cost in a different place.
The authenticator app asks for a few minutes once. Somebody installs it, scans a code, and after that signing in takes seconds. The effort sits at the start rather than at each sign-in. It also assumes a phone, which is worth checking rather than assuming.
The emailed code asks for nothing up front, because nobody installs anything. The cost is a small one at sign-in, and it depends on your email getting through. A trusted device can be remembered for up to 24 hours, which removes most of that cost for people at their own desk. Our piece on trusted devices covers how that window works and how to set it.
A passkey asks for a touch. Used in place of the password that is the whole sign-in, and used as a second factor it follows the password. Either way there is no code to read and nothing to type.
| Authenticator app | Emailed code | Passkey | |
| Who enrols | Each person, individually | Not applicable, it is an account-level option | Each person, individually, up to ten devices |
| Needs installing | Yes, an app on a phone | No | No, the device already does it |
| Where the effort falls | A few minutes once, per person | A small moment at sign-in | A moment at sign-in |
| Assumes a phone | Yes | No | No, any enrolled device |
| Repeat prompts | Each sign-in that asks for a second factor | A trusted device can be remembered for up to 24 hours | Each sign-in that asks for a passkey |
| Available on | All accounts by default | Account-level option | Enterprise accounts |
How do you require it of everyone?
Making a method available and requiring people to use it are two different things. The second is a separate capability rather than a stronger setting on the first. Mandatory MFA enrollment is the one that does it, with a grace period of up to 30 days. It is available as a paid option, configured with our team.
Get that distinction right before you answer a questionnaire, because the two questions sound alike and have different answers. Our piece on making enrolment mandatory covers how the grace period works and why it carries the whole rollout.
Which two factor authentication options suit a finance team?
A pattern worth considering. Start with the method your people can use on day one without new equipment. Then look at where your exposure sits and decide whether something stronger belongs on the account. Remember that the emailed code is an account-level choice, while the app is enrolled person by person.
That order matters more than the choice itself. Starting with what fits gives you something true to write down, and it protects the people who would otherwise put the whole thing off. Strength comes second, aimed where your exposure is worst. Both CISA and the UK National Cyber Security Centre publish guidance on multi-factor authentication worth reading alongside this.
What to settle before you choose
Three things, none of them technical.
- Who handles the person who loses their phone. Agree that inside your organization before the first person needs it, because the conversation goes badly when it starts from nothing.
- Whether everyone has a work phone. If a meaningful share of your people do not, the app method has a floor it cannot get past, and that decides the question for you.
- How often people sign in. Several times a day makes a per-sign-in cost noticeable, while twice a week makes it invisible.
Fit matters more than strength
If you take one thing from this, make it that. Arguments about two factor authentication options rank the methods by how hard each is to defeat, and then stop, as though the ranking settled it.
It does not, because a method has to survive contact with a working day. The one that fits how your people work is the one that stays switched on. A method nobody routes around protects more of your organization than a stronger one they avoid. So pick for fit first, then add strength where the exposure justifies it.
Identity is only half the question, and what somebody may reach once inside is the other half. Our guide to user permissions holds that half. For the broader picture, our overview of secure database management practices is a useful companion. To work out which method fits your organization, talk to an expert.
