Authenticator Assurance Level (AAL)
NIST 800-63B levels describing authentication strength. AAL1: single factor. AAL2: multi-factor. AAL3: multi-factor with phishing-resistant cryptographic authenticator (FIDO2, smartcards). Higher AAL is mandatory for higher-impact systems.
Assurance levels matter because they let a policy say "this action requires AAL2" instead of naming a specific product, which survives vendor changes. The practical jump is AAL2 to AAL3: push notifications and one-time codes satisfy AAL2 but are relayed by attacker-in-the-middle kits every day, while AAL3 requires a cryptographic authenticator bound to the origin. US federal systems and a growing set of regulated industries map controls directly to these levels.
See also: NIST 800-63, phishing-resistant MFA, WebAuthn and FIDO2, IAL
Related on Start with Identity
- GlossaryMFA Device
An MFA device is the physical thing a user has (a phone running an authenticator app, a hardware security key, a smart card, or an OTP token) that supplies the
- GlossaryMFA Fatigue
MFA fatigue, also called push bombing, is an attack in which someone who already has a user's password triggers push approval prompts over and over until the us
- GlossaryNumber Matching
Number matching is a push MFA design in which the sign-in screen shows a short number and the user must type that number into the authenticator app to approve,
- Blog46.5% of 2025-2026 identity breaches had no login for MFA to protect
SWI's Identity Breach Report 2026 classified 115 identity breaches from 2021 to October 2026. Where MFA status is known it was bypassed in 25 of 40 cases, and i
- Blog54% of business SaaS apps support passkeys or security keys. Only 13% let you require them
SWI's Phishing-Resistant MFA Support Matrix checked 95 business SaaS apps against their own documentation. 51 support passkeys or FIDO2 security keys, 12 let ad
- BlogEntra ID stops delivering SMS and voice codes on February 1, and global admins go last
From February 1, 2027, Microsoft stops providing SMS and voice authentication in Entra ID, and users with no other method must register a passkey to keep signin