What it means
The proofs come from different categories: something you know, such as a password, something you have, such as a phone or security key, and something you are, such as a fingerprint. Two passwords do not count, because both are the same kind of factor. Two-factor authentication is the case with exactly two factors, while MFA allows any number from two upward.
Why it matters when you buy software
Stolen or reused passwords are a common way into business accounts, and a second factor blocks most of those attempts. When you compare tools, check whether MFA is included on every plan or reserved for a higher tier, which methods are supported, such as authenticator apps, text message codes or hardware keys, and whether an admin can require it for all users.
How it works in practice
At sign-in, the user enters a password, then approves a prompt or types a time-limited code from an authenticator app. Hardware security keys work by touch. Admins usually set the rule for the whole organization and may offer recovery codes for lost devices. Text message codes are easy to use, though app and key methods resist interception better.
See also: Passkeys, Passwordless authentication and the glossary index.