Zero trust removes the idea that being inside the network earns trust, so each access request depends on who is asking and what device they use. Multi-factor authentication is the evidence behind that identity. Without it, a stolen password turns a zero trust design into a trust-the-password design.
What does zero trust actually say?
NIST SP 800-207 defines zero trust as an evolving set of paradigms that move defences from static, network based perimeters to users, assets and resources. It assumes no implicit trust is granted to assets or accounts based only on physical or network location, or on whether an asset is owned by the enterprise. Authentication and authorisation, for both subject and device, are discrete functions performed before a session to a resource is established.
Two ideas matter here. Decisions are made per request or per session, not once at the network edge. And they use more than a password: identity, device state and context.
Where does MFA fit?
MFA strengthens the authentication half of every decision. In a perimeter model, a single login at the VPN opened the door to much of the network. In a zero trust model, access to each application can require fresh, strong proof of identity, and access to sensitive ones can require more.
CISA's guidance on multifactor authentication describes it as one of the most effective steps to protect accounts, and CISA's Zero Trust Maturity Model puts identity, with phishing resistant MFA at its higher stages, as one of its pillars alongside devices, networks, applications and data.
Are all MFA methods equal?
No, and this is where designs go wrong. Codes sent by text message or generated by an app can be captured by a convincing fake login page and replayed in real time. Push approvals can be abused by flooding a user with prompts until one is accepted. Phishing resistant methods, such as hardware security keys and passkeys that use public key cryptography bound to the real site, defeat that relay.
NIST SP 800-63B groups authenticators by assurance level and recommends phishing resistant options for the highest levels. If your policy only says "MFA required", it may be satisfied by the weakest method. Name the allowed methods, and make phishing resistant ones mandatory for administrators and remote access first.
What is universal ZTNA?
Zero trust network access replaces broad network level remote access with per application access based on identity and device checks. "Universal" is a vendor style word for applying the same model to every user and location, in the office or away. The standard to hold it to is NIST SP 800-207's: policy decision before every session, least privilege, and monitoring that continues during the session. Judge any product against that, not against its marketing.
A constructed example
A company replaces its VPN with per application access. An engineer signs in from a managed laptop with a hardware key and reaches the code repository. When the same engineer tries the finance system from a personal tablet, the policy denies it, because the device is unmanaged. Weeks later a phishing page captures the engineer's password and a text message code. Without a hardware key bound to the real site, the attacker's session might have passed. With one, the relay fails and the attempt shows up in logs.
What should you watch for?
- Exceptions that bypass MFA for service accounts, break glass accounts or legacy applications. List them, protect them another way and review them.
- Recovery paths. If a help desk can reset a factor after a phone call, that is your real strength.
- Session lifetime. Long sessions reduce prompts and also extend the life of a stolen session.
- Coverage. One application without MFA can undo the rest.
How to check or apply this
- Inventory applications and mark which enforce MFA.
- Write down which MFA methods are allowed per risk level.
- Make phishing resistant methods mandatory for administrators and remote access.
- Replace broad network access with per application access where practical.
- Add device state to access decisions.
- Review exceptions and recovery processes quarterly.
- Log authentication events and alert on repeated prompts or impossible travel.
Quick check
Is MFA enough for zero trust?
No. It strengthens identity, but zero trust also uses device state, least privilege, segmentation and continuous monitoring.
Which MFA type resists phishing?
Hardware security keys and passkeys that bind the credential to the real site resist relay attacks. Codes and simple push approvals do not.
Sources
- NIST SP 800-207: Zero Trust Architecture
- CISA: Zero Trust Maturity Model
- CISA: Multifactor authentication
- NIST SP 800-63B
Last reviewed: 18 October 2026.
