Credential theft is now one of the easiest ways to take control over systems, which is why 2FA/MFA is an absolute security minimum—it remains effective even if a password is compromised. In the context of NIS2, multi-factor authentication directly supports access management and risk reduction requirements.

The key is understanding different needs: standard office users can usually rely on 2FA built into IAM platforms (Entra ID, Google, AWS) or on solutions such as Silverfort for on-premises Active Directory. Privileged users, however, often operate outside AD and the cloud—here, PAM-class tools such as Delinea are required, providing 2FA, session control, and full auditing.

Impersonating an employee—especially a privileged user—through stolen credentials (username and password) can lead to data breaches, system outages, or complete loss of control over IT infrastructure. An attacker with access to an administrator or office user account can not only steal information, but also erase traces of activity and escalate privileges. That is why two-factor authentication (2FA) is now a fundamental security baseline—it provides an effective barrier even when a password has been compromised.

2FA vs MFA

2FA (Two-Factor Authentication) is an authentication method that significantly increases account and system security by requiring identity confirmation using two independent factors. Most commonly, it combines something the user knows (e.g. a password) with something the user has (e.g. a mobile authenticator app like Google Authenticator or an SMS code).

The term MFA (Multi-Factor Authentication) is often used interchangeably with 2FA, although technically it refers to using two or more different authentication factor categories. Both approaches share the same goal: to effectively reduce the risk of unauthorized access, even if a user’s password is compromised.

2FA in the context of NIS2

NIS2 and the amendment to the National Cybersecurity System Act (KSC) impose an obligation on essential and important entities to implement “appropriate and proportionate risk management measures,” including:

• information system security policies,
• access management,
• protection against unauthorized access,
• supply chain security.

In the context of access management and protection, 2FA/MFA (Multi-Factor Authentication) is one of the most effective and widely recognized mechanisms.

The evolution of authentication – from legacy Active Directory to hybrid IAM models

In the past, authentication in Microsoft environments was based primarily on classic domains using Active Directory (AD), where login relied on a username and password, sometimes supplemented with tokens or certificates. Over time, AD became a standard—many systems integrated with it, and its authentication mechanisms were used almost everywhere.

With the growth of cloud environments, Microsoft introduced a modern identity management service—Entra ID (the successor to Azure AD)—which natively supports multi-factor authentication and enables hybrid environments combining on-prem AD with the cloud. This approach addresses the needs of organizations using Microsoft 365 that require flexible and secure identity management.

Other vendors followed a similar path, such as Google (Secure LDAP) and AWS (Directory Service), offering their own IAM (Identity and Access Management) services with built-in 2FA. However, it is important to note that these solutions do not cover login control and system changes performed by privileged users—administrators and system operators—who typically work outside AD and the cloud. In such cases, implementing a PAM (Privileged Access Management) system is essential, enabling secure authentication and activity control even in environments that do not support classic AD.

Two MFA perspectives: office users vs privileged users

When implementing multi-factor authentication, it is important to distinguish between two main user groups with fundamentally different needs and requirements.

The first group consists of office users who rely on cloud-based identity and access management services such as Microsoft Entra ID, Google Secure LDAP, or AWS Directory Service, all of which include built-in 2FA. If an organization does not use cloud services and relies on on-premises Active Directory, it must use a third-party 2FA solution.

The second group consists of privileged users—network administrators, database administrators, telecom and industrial system operators—who typically work on systems not integrated with AD. These systems often use their own authentication mechanisms, making straightforward 2FA integration difficult.

How to choose the right 2FA solution for your IT architecture and needs

In practice, implementing 2FA/MFA requires considering several important technical aspects.

If an organization operates in a cloud environment or Windows-based systems, implementing 2FA is usually straightforward. Challenges arise where systems cannot be integrated with AD—for example, certain databases, routers, switches, or legacy network devices—or where integration is limited (e.g. Linux).

Depending on user types and IT architecture, the choice of a 2FA solution can vary significantly.

1. Office users working in on-premises Active Directory environments

Office users operating in on-premises Active Directory environments can easily leverage Silverfort. This unified identity protection platform provides, among other capabilities, 2FA that integrates directly with AD without requiring agents on target systems (with the exception of Windows Logon). It enables rapid deployment of two-factor authentication without the need to migrate to the cloud.

Silverfort extends access management capabilities by allowing granular security policies for both user and service accounts. A key feature is its deep integration with Active Directory, which serves as the foundation of the solution. It is an ideal option for organizations with legacy technology stacks that want to improve security without a major infrastructure overhaul.

Silverfort can also quickly improve security for privileged users—provided they operate on Windows systems. In Windows, Linux, or other non-AD environments, a PAM solution such as Delinea will be required.

2. Privileged users

Even if an organization uses Entra ID or classic Active Directory, privileged administrator access usually remains outside the scope of those tools—this is where Delinea excels. Delinea’s 2FA capabilities are particularly effective in organizations with large, heterogeneous IT infrastructures. The platform provides full visibility into administrator activities, accountability, and compliance with audit and regulatory requirements.

Although Delinea can also integrate with Active Directory and extend protection to office users, such deployments are significantly more complex than using Silverfort. As a result, they are often not cost-effective for smaller organizations that do not require PAM-class capabilities.

It is also important to remember that Delinea requires agent installation, which may be impossible in some environments—such as switches or routers. In these cases, Silverfort’s agentless 2FA, directly integrated with Active Directory, may be the better choice.

In summary, Delinea 2FA is best suited for organizations that require full control over privileged access in heterogeneous IT environments, with auditing, entitlement management, and protection beyond traditional domain structures. Silverfort is a better choice for organizations with simpler infrastructures that rely solely on on-premises Active Directory and need an easy-to-deploy 2FA solution.

Additionally, both Silverfort and Delinea support integration with YubiKey hardware keys, enabling strong, physical authentication methods. Both platforms also support 2FA at the Windows endpoint level via Windows Logon.

Not sure which 2FA solution fits your organization? Or are you ready to implement one? Get in touch with our team of specialists.

This article was prepared by a 4Prime expert and subsequently edited with the support of artificial intelligence tools.