Multifactor authentication combines different kinds of evidence when checking an identity. Factors commonly involve something the user knows, possesses or is. Combining independent categories can reduce reliance on a password alone, although the strength depends on the actual methods and recovery process.
Two steps are not necessarily two factors: asking for two passwords still relies on knowledge. Authentication also remains separate from authorisation, which controls what an authenticated identity may access or change.
ELI5
A system can ask for more than one kind of proof that you are allowed in. Knowing a password is one kind; possessing a particular security device is another.
For example, signing in might require a password and confirmation using a registered security key. Someone who learns only the password would still lack the other required proof.
Are two passwords multifactor authentication?
No. Both rely on the same category of factor: something the person knows. Multifactor authentication combines different categories.
Does multifactor authentication decide what a user can do?
It helps verify an identity. Separate permission rules determine which resources or actions that identity is authorised to use.
