A method that requires two or more factors from different categories: something you know (password, PIN), something you have (phone, security key), and something you are (biometrics). Two passwords aren't MFA because they belong to the same category.
In SC-900 it is combined with Conditional Access and authentication strength. Microsoft Authenticator uses number matching to stop MFA fatigue attacks, and Microsoft retires its own SMS and voice delivery starting February 2027.
Multifactor authentication (MFA) is a concept that can show up on the exam. Check the full guide to see it in context.