Security measures often feel like they're just making life harder for end users. Meanwhile, attackers are out there finding clever ways to bypass these tools. They love it when users get frustrated because it makes phishing campaigns and stealing those long, complex passwords a breeze.
Multi-factor authentication (MFA) stepped in to stop these criminals from effectively accessing company resources using stolen passwords. But if users are already triggered by complex password policies, adding yet another step to the authentication process makes the matter go from bad to worse — in their eyes, at least.
That's where adaptive MFA comes in.
Rather than challenging every user every time, it adjusts authentication requirements based on the actual risk of each login attempt. The idea is simple: users who log in from the same device, the same network, at the same time every day don't need to be challenged like someone logging in from an unfamiliar device at 3am from a country they've never visited. Adaptive MFA can tell the difference. Standard MFA cannot.
While early versions of adaptive MFA required significant configuration work, the category has matured considerably. Modern implementations, like Intelligent MFA in FusionAuth 1.68.0, handle the risk-scoring engine automatically. No custom code, no external services, no manual trigger.
Adaptive MFA remains a critical component of any modern authentication strategy. This post walks through what adaptive MFA solves, how it works, and what today's implementations look like in practice.
Limitations of Traditional MFA#
A traditional approach to MFA is usually a huge step up in securing organizations. It solves weak-password issues by adding an additional layer of authentication that makes unauthorized access hard for most attackers.
But like most things in life, MFA comes with certain drawbacks.
Users Find MFA Inconvenient#
Yes, cybersecurity experts and enthusiasts love this great cyberattacker stopper. But regular users find using MFA to be a real challenge.
Most users have way too much to do. A never-ending cycle of to-dos, meetings, and emails. Having to take an extra step to log in just so they can carry on with their work is a complete nuisance.
Users' most common complaint about MFA is how time-consuming and inconvenient it is to authenticate twice, often with additional steps that require them to switch between tabs, apps, or devices. They might even need to wait for an SMS message that never reaches their phone.
That friction frustrates users, who often make their dissatisfaction known. While IT and security teams understand why strong authentication matters, executives and board members are more likely to be concerned about the impact on productivity and user experience than on security risks that haven't yet materialized.
For consumer-facing applications, the stakes are even higher. An annoyed employee logs a ticket. An annoyed customer takes their business elsewhere.
Not All MFA Is More Secure#
Another important thing to keep in mind is that some methods of MFA can actually create even greater vulnerabilities.
For example, SMS and email authentication are the least secure MFA authentication methodologies. Getting a six-digit code in an email account that's not secured by MFA and might have much less robust password protection can leave you exposed.
Likewise, SMS MFA is vulnerable to hackers that perform SIM swap attacks. They can clone SIM cards to have messages and calls redirected to the attacker's phone.
MFA for the sake of MFA is not the same as using MFA to strengthen security.
What Is Adaptive MFA?#
Traditional MFA applies the same authentication requirements to every login. Adaptive MFA takes a more intelligent approach, adjusting authentication based on the context of each login attempt.
Instead of challenging every user every time, adaptive MFA evaluates signals such as the user's location, device, network, IP address, and recent behavior to determine the level of risk. Low-risk logins may require only a password, while higher-risk attempts trigger additional authentication factors.
For instance, if an office network is considered secure due to tight security controls such as firewalls, access control lists, and restrictions, a user attempting to log in from the office network likely wouldn't be prompted to reauthenticate using MFA.
Adaptive MFA also allows system administrators and security professionals to choose whether to enforce access with MFA using the user's geolocation data or IP address identifications. If impossible travel or an untrusted IP is detected, MFA will be triggered and prompt the user to perform the additional authentication.
How Adaptive MFA Detects Risk#
Adaptive MFA is effective because it evaluates the context of every login instead of treating every authentication attempt the same. By analyzing user behavior patterns and contextual signals (often referred to as user and entity behavior analytics (UEBA)) it can distinguish between routine activity and behavior that warrants additional verification.
For example, imagine a user who typically works Monday through Friday between 8:00 a.m. and 5:00 p.m. If that user suddenly attempts to log in at 10:00 p.m. on a Saturday, the login may be flagged as suspicious and require an additional authentication factor. The same is true if the login originates from a known malicious IP address or another high-risk source.
Benefits of Adaptive MFA#
Because authentication requirements are based on risk, adaptive MFA improves security without creating unnecessary friction for legitimate users. Instead of challenging every login, organizations can focus stronger authentication on the attempts that matter most.
Adaptive MFA is even more effective when integrated with existing identity and security systems. Whether deployed alongside identity and access management (IAM), customer identity and access management (CIAM), customer relationship management (CRM) platforms, or other enterprise applications, integrations help organizations apply consistent authentication policies across every entry point.
Many adaptive MFA platforms also integrate with SIEMs, threat intelligence platforms, and other security tools through APIs. These integrations enable automated workflows, such as user provisioning, profile updates, and step-up authentication based on changing risk conditions, while giving security teams greater visibility into authentication activity across the organization.
Adaptive MFA Strikes a Better Balance between Simplicity and Security#
Since adaptive MFA works with behavioral patterns, geolocation, and trusted IPs, users who regularly work within the same "safe" conditions are not prompted for MFA authentication. In internal networks, adaptive MFA can even be integrated with single sign-on (SSO). That means those who work on an SSO-enabled device will not even need a password to log in as long as they work from their safe device and within trusted boundaries (IPs, geolocation, etc.).
Adding simplicity to security is particularly useful in certain situations:
-
Where the user is your customer. You'll notice that e-commerce services such as eBay or Amazon ask for little to no authentication when you log in from the same network and device as usual (this is UEBA at work). But they will prompt you for MFA for more sensitive tasks such as adding or removing a credit card.
-
In the healthcare industry. Healthcare workers are governed by strict legislation such as HIPAA to protect patients' personally identifiable information (PII). Adaptive MFA allows them to work more seamlessly while complying with security regulations.
-
On mobile devices. Prompting users for excessive written credentials and asking them to swap between apps for authentication is especially grating on mobile devices. Adaptive MFA makes simplicity and fluency a reality with smartphones.
Adaptive MFA Is a Valuable Investment#
Like many security initiatives, adaptive MFA requires an upfront investment in technology, implementation, and ongoing management. For organizations focused on controlling costs, that can make adoption feel like a difficult decision.
The complexity of deployment also varies by platform. For example, implementing adaptive MFA in Microsoft Entra ID often involves enabling MFA for all users, configuring Conditional Access policies, and layering in additional risk signals such as risky users and risky sign-ins to create more granular authentication decisions. Other platforms may take a different approach, but adaptive MFA is rarely a feature that's simply switched on.
The return on that investment is stronger security with less friction for legitimate users. By challenging users only when the risk warrants it, organizations can reduce help desk tickets, improve the user experience, and encourage higher MFA adoption rates. Greater adoption means more accounts are protected, reducing the likelihood of credential-based attacks and costly data breaches.
Where Intelligent MFA Takes It Further#
The principles above describe what adaptive MFA is supposed to do. But in practice, most implementations have fallen short of the promise in two specific ways.
First, many systems rely on a small number of signals. Enough to catch obvious cases but not enough to identify the subtler patterns that experienced attackers know to stay within. A login from a dormant account with a stale password and a browser fingerprint that matches known attack tooling isn't caught by three signals. It's definitely caught by ten.
Second, many risk engines run on the vendor's infrastructure. That means your users' authentication data leaves your environment to get scored. For teams with GDPR obligations, data residency requirements, or regulated-industry constraints, that's a real problem.
FusionAuth 1.68 introduces Intelligent MFA, a built-in risk-scoring engine that addresses both of these gaps. Here's how it works.
The 10-Signal Risk Engine#
Every login is evaluated against up to ten independent signals before a challenge decision is made. Each signal is scored HIGH, MEDIUM, or LOW:
| Risk Signal | Behavior Identifier |
|---|---|
| Impossible Travel | The account just logged in from a location physically impossible to reach since the last login, which strongly suggests credentials are being used by two different parties. One of them could be an attacker. |
| Untrusted Device | The user never marked this device as "remembered" during a prior MFA prompt, so we have no standing signal that they personally vouch for it. Absence of that trust marker warrants re-verifying identity. |
| Unrecognized Device | This device has never been seen on the account before. New hardware is a classic indicator of credential theft or session hijacking, so confirm the person is really them. |
| Blacklisted IP | The login originates from an IP on a known-malicious set tied to attacks, botnets, or abuse. Traffic from these sources is far more likely to be hostile. |
| Stale Credentials | The password is many months or even years old, giving it a long window to have leaked in a breach or been guessed. Stale credentials are more likely already compromised. |
| Suspicious Password Reset | The password was changed recently, which is exactly what an attacker does right after taking over an account to lock out the real owner. A fresh change so recently is suspicious until proven legitimate. |
| Account Owner Change | A login identifier was added or changed recently, a common takeover move to hijack recovery and notifications. The recency of the change is the red flag, and risk drops the longer ago it happened. |
| Dormant Account Reactivation | The account has been dormant for a long time, a prime target since the real owner isn't watching for unauthorized access. Reactivation after long silence often signals takeover. |
| Suspicious Browser | The browser/client string matches a list of known-bad user agents associated with attack tooling. Such fingerprints rarely belong to genuine human sessions. |
| Bot Detected | Input timing indicates a bot or automated system rather than a human. Automation at the login screen points to credential stuffing or scripted abuse. |
The individual signal scores combine into a single composite. More HIGH signals raise that average, but the result is still bucketed as LOW, MEDIUM, or HIGH. You configure the policy: challenge only on HIGH, or challenge on HIGH and MEDIUM.
A returning user on a known device with a recent login and a clean IP scores LOW and passes through with no friction. A login from an unrecognized device on a flagged IP, with a password unchanged for eight months, stacks HIGH across multiple signals, triggering the policy automatically. No custom code required.
Deterministic Scoring: Why It Matters for Compliance#
Most vendor risk engines use machine learning (ML). ML-based scoring can catch patterns a rules-based system might miss, but it has a real cost for compliance teams: it can't explain itself at the signal level. When an auditor asks why a specific user was challenged on a specific date, you won't have a documented answer.
Intelligent MFA uses deterministic scoring. Every challenge decision is driven by named signals, each mapped to a risk level, combined into a composite score. The composite score is logged in your event log. On Enterprise, per-signal detail flows to your SIEM via dedicated webhooks — so when the question comes up (and in SOC 2, ISO 27001, and NIST 800-63B reviews, it will) you have a documented, reproducible answer.
Conclusion#
Adaptive MFA represents an important shift in how organizations think about authentication. Instead of treating every login as either equally trustworthy or equally suspicious, it evaluates the context of each authentication attempt and responds accordingly.
That shift delivers benefits on both sides of the equation. Legitimate users encounter fewer unnecessary challenges, while suspicious login attempts face stronger verification. The result is a better balance between security and usability, one that reduces friction without lowering defenses.
As adaptive MFA continues to evolve, organizations have access to richer risk signals, more transparent decision-making, and greater flexibility in how authentication policies are applied. The question is no longer whether adaptive MFA improves on traditional MFA. It's how effectively your implementation can distinguish between trusted users and genuine threats.
To see how Intelligent MFA handles a real login flow, request a demo. You'll walk through a scored session (one clean, one suspicious) and see exactly where the policy challenges and where it doesn't.
