Single sign-on and multi-factor authentication solve different problems

These two get set against each other constantly, usually in a piece asking which one you should adopt. They are not alternatives. Single sign-on changes how many credentials exist and where they live. Multi-factor authentication changes what it takes to use one. The interesting decision is not between them; it is which second factor you put behind whichever login ends up mattering most.

Use both — they are not alternatives

Use both, and do not treat them as competing options. Single sign-on means one strong, well-protected account stands behind many services. Multi-factor authentication is what makes that one account hard to take over. Without the second factor, single sign-on concentrates risk rather than reducing it.

If you only have the appetite for one change today, add a phishing-resistant second factor to the account that everything else already depends on — almost always your email.

What each one actually does to the risk

Single sign-on shrinks the number of passwords in existence. Fewer passwords means fewer chances to reuse one, fewer credentials sitting in breach corpuses, and fewer forms where you type a secret. That is a genuine reduction, and it is the reason ‘sign in with’ buttons became normal.

What it does not do is make the remaining login stronger. It makes it more valuable. Everything that used to be spread across twenty accounts now hangs off one.

Multi-factor authentication works on the other axis. It says that knowing the password is insufficient. NIST is direct about why this is needed: passwords are ‘not phishing-resistant’, full stop, whatever their length.

How CISA and NIST rank the second factor

This is where most articles stop too early, treating all MFA as one thing. The agencies do not.

CISA publishes a four-tier hierarchy. At the top is phishing-resistant MFA — FIDO/WebAuthn and PKI — and CISA states that ‘The only widely available phishing-resistant authentication is FIDO/WebAuthn authentication.’ Below that sit app-based one-time codes and push with number matching, then push without number matching, then SMS and voice at the bottom.

NIST reaches the same place by a different route, classing out-of-band authentication over the telephone network as RESTRICTED. Verifiers using it should watch for risk indicators such as device swap, SIM change and number porting, and must ensure alternative authenticator types are available. Email is not permitted as an out-of-band channel at all.

NCSC UK’s comparison paper is blunter still: every traditional factor is vulnerable to adversary-in-the-middle phishing, and no FIDO2 credential type is.

Deciding what to enable, in what order

1. Enable a passkey or security key on any account that offers one, starting with email, then banking, then the password manager.
2. Where passkeys are not offered, use an authenticator app rather than text messages, and prefer push prompts that require number matching.
3. Keep SMS only where it is the sole option. CISA’s position stands: any MFA beats none. Ranking it last is not the same as telling you to turn it off.
4. Where you use a ‘sign in with’ button, treat the underlying account as critical infrastructure and protect it accordingly.
5. Do not accept security questions as a fallback factor. NIST prohibits verifiers from prompting for knowledge-based authentication.

The mistakes that make either one worse

The first is enabling single sign-on on an account whose own login is still just a password. That is not consolidation, it is a single point of failure with a friendly button.

The second is assuming the second factor is a phishing cure. It is not: NCSC’s finding is that traditional factors are all phishable in real time by a site relaying your code. Only FIDO2 credentials resist it, because the credential is bound to the site it was created for.

The third is leaving SMS enabled as a backup on an account that also has a passkey. If the weakest route still works, the account’s strength is the weakest route. Where a service lets you remove the phone number as a recovery method once a stronger factor is in place, do it.

The fourth is quieter. Consolidating logins behind one provider also consolidates the consequences of losing that provider — not to an attacker, but to a locked account, a closed workplace or a forgotten recovery route. Keep at least one independent way into anything you would genuinely miss, and keep the recovery material for it somewhere physical.

What NIST says about passkeys, in full

Since passkeys come out on top of every ranking above, the honest version includes the caveat. NIST notes that syncable authenticators — the sync-fabric model behind consumer passkeys, where the credential is copied between your devices — shall not be used at the highest assurance level, AAL3, because the key can be exported.

That limit is about high-assurance government systems, not about whether you should use a passkey for your email. For consumer accounts the comparison that matters is against a password and an SMS code, and there the passkey wins on every published measure. But an article that presents passkeys as unimprovable is leaving out something the standard says out loud.

CISA’s summary position is still the one to act on: any MFA is better than no MFA, and users who enable it are significantly less likely to be hacked. Note that CISA’s consumer page states no percentage for that, so treat any specific figure you see quoted as unsourced.

Sources: CISA — implementing phishing-resistant MFA · CISA — multi-factor authentication · NIST SP 800-63B-4, Digital Identity Guidelines · NCSC UK — traditional credentials and FIDO2 for personal use

Reviewed 27 August 2026 by the CyberArtical editorial team against primary guidance from CISA, NIST and NCSC UK. Security guidance changes over time; where our earlier version of this page said something different, we say so in the article rather than editing it out quietly.