Multi-factor authentication: Behavior and lifecycle

Short-lived MFA challenges bind to a pending session, step-up gates sensitive actions, recovery codes are single-use, and a password replay cannot skip an in-progress or required second factor.

Published Sep 12, 2026