Skip the experience — though the experience is the point
Alen JosephCORP\alen.joseph
Windows logon MFA
The login before the browser.
The second factor at the OS login — not a browser pretending to be one.
Alen JosephCORP\alen.joseph scroll to open the laptop
Signed in with a second factor the OS asked for — not the browser.Verified with a second factor · Windows logon · WKS-4471
The six factors
Six ways to answer, one place it is asked.
The Windows logon is the surface most MFA never reaches, because most MFA lives in a browser. InstaSafe puts the challenge in the OS sign-in itself — the agent brings the tunnel up before anyone has signed in, which is what lets a domain login work on a laptop sitting in a hotel.
SMS OTPA one-time code to the enrolled number. The oldest second factor, and still the one that reaches a person with no app installed.
Email OTPThe same code to the mailbox on file. Useful where the phone is the thing that was lost, which is exactly when a recovery path matters.
AuthenticatorA TOTP code that rotates on a fixed period. Nothing is transmitted to be intercepted — the code is derived from a shared secret and the clock.
Push approvalThe request arrives on the paired phone carrying the device, IP and location it came from, so approving is a decision rather than a reflex.
Hardware keyFIDO2 / WebAuthn. The key signs a challenge bound to the origin, which is what makes it the factor a convincing phishing page cannot borrow.
BiometricThe reader already in the palm rest. The print is matched on the device; only the verdict travels, and nothing about the finger leaves the machine.
See it on your own machinesBack to Multi-Factor AuthenticationHow the pre-logon tunnel works