Multi-factor authentication (MFA) verifies an identity using more than one distinct authentication factor, commonly knowledge, possession or inherence. Two passwords are not two factors; a password and a hardware security key are.
MFA reduces account-takeover risk but does not determine whether the resulting access is appropriate. IGA and authorization controls remain necessary.